Method and apparatus for controlling a nuclear reactor

ABSTRACT

A control system and method for a nuclear steam supply system for continuously predicting the pending violation of one of the system&#39;s design limits. The prediction is made far enough into the future to allow corrective or protective action to be implemented in a timely manner in order to avoid violation of a design limit even on the occurrence of a worst case accident, or, restated, the occurrence of an accident which causes a most rapid approach to the design limit. Various parameters of the nuclear steam supply system are monitored and fed to a calculating mechanism. Samples of these parameters are periodically taken for the periodic detailed calculation of an index representative of the proximity of violation of the appropriate design limit. Continuous readings of these same parameters are taken for the purpose of making continuous updates of the last calculated index. Also, on a continuous basis, continuous readings of the rate of change (slope) of selected parameters are taken and calculations made on the basis of the rate of change of those parameters to obtain a prediction of the parameter a certain time (T) into the future. Modifications to the index are continuously made to the last calculated value of the index to give a prediction of the index (T) seconds into the future. When this predicted index violates a preselected set point, indicating the impending actual violation of a design limit, a signal may be generated to institute protective action which can be accomplished in the T seconds over which the prediction was made.

The following allowed and issued patents are herein incorporated byreference: U.S. Pat. No. 3,752,735 issued on Aug. 14, 1973 entitled"Instrumentation for Nuclear Reactor" invented by Charles R. Musick andRichard P. Remshaw. U.S. Pat. No. 3,356,577 issued to Ygal Fishman onDec. 5, 1967 entitled "Apparatus for Determining the InstantaneousOutput of a Nuclear Reactor".

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to safety systems for nuclear reactors.More specifically, this invention is directed to the prediction ofinternal reactor conditions commensurate with maintaining the integrityof the fuel element cladding. Accordingly, the general object of thepresent invention is to provide novel and improved apparatus and methodsof such character.

The performance of a nuclear reactor, like that of many other energyconversion devices, is limited by the temperatures which componentmaterials will tolerate without failure. In the case of a reactor with acore comprising an assemblage of fuel assemblies which in turn consistof an array of fuel rods or pins, the upper limit of temperature isimposed by the fuel rod or fuel pin cladding material employed. In orderto adequately protect the reactor core against excessive temperatures,it is necessary to examine the temperature of the "hottest" fuel pin orthe "hottest" coolant channel between adjacent fuel pins of the core,since damage will first occur in the "hottest" fuel pin. Thus the"hottest" pin or channel becomes the limiting pin or channel for thereactor core.

As is well known, heat is generated in a reactor by the fission processin the fuel material. The fission process, however, produces not onlyheat but radioactive isotopes which are potentially harmful and whichmust be prevented from escaping to the environment. To this end, thefuel is clad with a material which retains the fission products. Inorder to prevent clad overheating and in the interest of precludingrelease of the fission products which would occur on clad damage orfailure, a coolant is circulated through the reactor core. Heattransferred to the circulating coolant from the fuel elements isextracted therefrom in the form of usable energy downstream of thereactor core in a steam generator. Thus, for example, in a pressurizedwater reactor system, the water flowing through the core is kept underpressure and is pumped to the tube side of a steam generator where itsheat is transferred to water on the shell side of the generator. Thewater on the shell side is under lower pressure and thus the thermalenergy transfer causes the secondary water to boil and the steam sogenerated is employed to drive the turbine.

To summarize, in the design and operation of a nuclear reactor, thebasic objective of removing heat from the fuel must be obtained withoutallowing the temperature of the fuel cladding of the limiting fuel pinto rise to such a degree that the clad will fail.

As the coolant circulates through the reactor core, heat will betransferred thereto either through subcooled convection, often referredto as film conduction, or through nucleate boiling. Nucleate boilingoccurs at higher levels of heat flux and is the preferred mode ofoperation since it permits more energy to be transferred to the coolantthereby permitting the reactor to be operated at higher levels ofefficiency. Nucleate boiling is characterized by the formation of steambubbles at nucleation sites on the heat transfer surfaces. These bubblesbreak away from the surface and are carried into the main coolantstream. If the bulk coolant enthalpy is below saturation, the steambubbles collapse with no net vapor formation in the channel. Thisphenomenon is called subcooled boiling or local boiling. If the bulkfluid enthalpy is at or above the enthalpy of saturated liquid, thesteam bubbles do not collapse and the coolant is said to be in bulkboiling.

If the heat flux is increased to a sufficiently high value, the bubblesformed on the heat transfer surface during nucleate boiling are formedat such a high rate that they cannot be carried away as rapidly as theyare formed. The bubbles then tend to coalesce on the heat transfersurface and form a vapor blanket or film. This film imposes a highresistance to heat transfer and the temperature drop across the film canbecome very large even though there is no further increase in heat flux.The transition from nucleate boiling to film boiling is called"departure from nucleate boiling", hereinafter referred to as DNB, andthe value of the heat flux at which it occurs is called the "DNB heatflux" in a pressurized water reactor or the "critical heat flux" in aboiling water reactor. A factor also to be considered is the creation offlow instabilities resulting from excessive coolant void fractions.

Another condition which requires protective action is the occurrence ofa high local power density in one of the fuel pins. An excessive localpower density initiates centerline fuel melting which may lead to aviolation of the fuel clad integrity. In addition, a condition ofexcessive local power density is unacceptable in the event of a Loss ofCoolant Accident (LOCA) since excessive local power densities wouldcause the clad temperature to exceed allowable limits if the coolantwere lost. As the result of analyses of Loss of Coolant Accidents,values are established by the reactor designers for the maximumallowable local power densities at the inception of a LOCA such that thecriteria for acceptable consequences are met. The maximum local powerdensity or local power limit is generally specified as a kilowatt perfoot (KW/ft) limit.

A third condition which acts as an operating limit is the licensed powerat which the particular reactor is permitted to run. All three of these"limiting conditions for operation" must be monitored in order to makereactor operation safe. Since clad damage is likely to occur because ofa decrease in heat transfer coefficient and the accompanying higher cladtemperatures which may result when DNB occurs, or because of anexcessive local power density, the onset of these conditions must besensed or predicted and corrective action in the form of a reduction infission rate promptly instituted. Restated, in reactor operation DNBmust be prevented since the concurrent reduction in clad strength astemperature increases can lead to a clad failure because of the externalcoolant pressure or because of the internal fission gas pressures in thefuel rod. One way of monitoring DNB in the reactor is to generate anindex or a correlation which indicates the reactor condition withrespect to the probability of the occurrence of DNB. (See L. S. Tong,"Prediction of DNB for an Axially Non-uniform Heat Flux Distribution",Journal of Nuclear Energy, 21:241, 1967). This correlation isalternatively called Departure from Nucleate Boiling Ratio (DNBR) orCritical Heat Flux Ratio and is defined as the ratio of the heat fluxnecessary to achieve DNB at specific local coolant conditions to theactual local heat flux. The two correlations stem from slightlydiffering statistical derivations so that the critical values of DNBRand critical heat flux ratio are defined to be 1.3 and 1 respectively.These are the statistically established limiting values above which DNBhas a very small probability of occurring. In the following discussionand claims, it should be understood that DNBR will be used, for the sakeof simplicity, as describing both of the correlations. Thus, DNBR forthe purposes of this discussion and description, shall mean both theTong W-3 correlation for Departure from Nucleate Boiling Ratio and theCritical Heat Flux Ratio Correlation. Additionally, an excessive KW/ft.in the limiting or "hottest" fuel pin in the core must be avoided inorder to maintain the integrity of the cladding or to prevent violationof the limiting conditions for operation established by a Loss ofCoolant Accident analysis.

It is known that DNB occurs as a function of the reactor operatingparameters of heat flux or power distribution, primary coolant mass flowrate, primary coolant pressure and primary coolant temperature. In orderto prevent an excessive KW/ft. or DNB (also called "burn-out") or"boiling crisis", reactor protective systems must be designed to insurethat reactor operation is rapidly curtailed, a condition known in theart as "reactor trip" or "reactor scram", before the combination ofconditions commensurate with DNB or excessive local power density canexist. Departure from nucleate boiling and DNB Ratio may be expressedfor one fuel pin or channel as:

(1) DNBR-f(φ, Tc, P, m, F_(r), F_(z) (z), T_(r))

and the LOCA or centerline fuel melt limit may be expressed as:

(2) KW/FT limit=f(φ, F_(r), F_(z) (z))

where:

φ=Core Power in Percent of Fuel Power

T_(c) =Coolant Inlet Temperature

P=Coolant Pressure

m=Coolant Mass Flow Rate

F_(r) =Integral Radial Power Peaking Factor

F_(z) (z)=Axial Power Distribution in the Pin which has the IntegralRadial Power Peaking Factor

T_(r) =Azimuthal tilt magnitude which is a measure of side to side xenonoscillation

Core power in percent of full power may be determined in a mannersimilar to that disclosed in the referenced U.S. Pat. No. 3,752,735entitled "Instrumentation for Nuclear Reactor". Integral radial powerpeaking factor is defined as the maximum ratio of power generated in anyfuel pin in the core to the average fuel pin power.

Axial power distribution is defined for each fuel pin as a curve oflocal pin power density versus axial distance up the pin divided by thetotal power generated in the pin. See the "Description of the PreferredEmbodiment" and the "Appendix to the Description of the PreferredEmbodiment" for a more detailed discussion.

The other parameters of coolant inlet temperature, reactor coolantsystem pressure and coolant mass flow rate may be determined inconventional manners. For example, see co-pending U.S. Pat. No.3,791,922 entitled "Thermal Margin Protection System" filed Nov. 23,1970, for methods for obtaining coolant inlet temperature. An accuratemeasure of coolant mass flow rate may be obtained from the speed of thecoolant pumps. A very accurate and low noise signal may be obtained fromthe shaft associated with the coolant pumps to determine the pump speed.Each shaft is provided with a large number of teeth or notches aroundits periphery. Means such as a transducer are provided for detecting thepassage of the teeth past a fixed position. The output signal from thetransducer consists of an extremely regular pulsed signal with afrequency directly related to the pump speed which is, in turn, directlyrelated to the coolant flow.

In the first equation for DNBR, it is important to recognize that avalue of DNBR above 1.3 results in a high probability that acceptablethermal values would exist in the core such that a departure fromnucleate boiling would not occur. However, when the DNBR falls belowthis value, the probability of DNB and clad failure would be expected toincrease to unacceptable values. Similarly in equation (2) the KW/ft.limit on the left hand side of the equation is a fixed number determinedeither by LOCA or the local power density that causes the degree ofcenterline fuel melting which is adopted as the fuel design limit by thereactor designers. For purposes of generalization and for the purposesof this disclosure, both the DNBR and KW/ft. can be thought of asindices which are indicative of the proximity of operation to theappropriate design limit. The same or similar treatment can be made forany design limit which is amenable to a mathematical representation.Therefore, this invention is applicable to any design limit and anyindex which can be generated mathematically from parameters of thesystem.

2. Description of the Prior Art

Heretofore, the prior art has attempted core protection through meansand methods that have sacrificed plant capacity and availability.Various schemes with different degrees of sophistication wereimplemented, none of which enabled the utilization of the plant's fullpotential. The least sophisticated system consisted of the establishmentof a series of independent limits for each of the parameters upon whichthe design limit in question depended. By so doing, this prior artmethod could not account for the functional interdependence of all ofthe variables. Thus, the situation could arise in which one parameterdeviated from its optimum value, without causing an approach to thedesign limit since the other parameters on which the design limitdepended might have compensated for the one bad parametric value.Nevertheless, under this prior art system, a reactor trip would havebeen initiated if the deviation of the one parameter caused theparametric value to exceed the independently determined envelope forthat parameter.

A second more sophisticated prior art scheme attempted to utilize, to agreater degree, the functional dependence of the design limit index onthe plurality of parameters. However, even in this more sophisticatedscheme, certain approximations and assumptions were made to render thefunctional dependence simple enough so that it could be easilyreproduced in analogue circuitry. A typical type of assumption which hadto be made was to assume that as many as two or three parameters wereeither constants held at their design values or were variables whichvaried only within their allowed envelopes. This second moresophisticated prior art scheme increased the plant availability andcapability but, nonetheless, could not approach the optimum operatingconditions since the calculations were limited by the degree ofrefinement which was allowed by the analogue circuitry.

Another common failing of the prior art systems was that there was oftenno recognition of the fact that it is not sufficient merely to avoiddesign limit violation on steady state operation, but design limitviolation must also be avoided on the occurrence of accidents whichcause rapid approach to the design limit. Thus, prior art systems oftenpermitted operation close to the design limit on a steady state basis,without provision for avoiding design limit violation on the occurrenceof an anticipated operational occurrence (which is defined as acondition of normal operation which is expected to occur one or moretimes during the life of a nuclear power plant). The trend toward verylarge and high power nuclear reactors results in core dynamics notpreviously considered a problem. Axial and azimuthal xenon oscillations,as well as xenon redistribution after power changes, must be taken intoconsideration. With reactors operating close to thermal--hydrauliclimits, these transient conditions must be coped with relativelyquickly. Because of the complexity of determining the core powerdistribution, an on-line computer is necessary to aid the operator indetermining the control actions necessary to maintain the reactor withinoperational limits. Only by use of plant computers can surveillance andassimilation of the large quantity of plant parameters be handled.

Demands for greater reactor availability and increased emphasis placedon safety requirements designed to protect the reactor's core and theintegrity of fuel rod cladding cogently point out the need for aflexible and rapid system which not only prevents the core fromexceeding its safety limits but also allows operation of the reactorclose to those limits in order to maximize reactor efficiency andavailability. Such a protection system must consist of two components:One system for sensing reactor conditions and tripping the reactor whena safety limit violation is imminent, and a second system forcalculating the appropriate operating limits which would insure that theprotection system has sufficient time to safely trip the reactor whileat the same time allowing maximum use of the reactor. In the followingdiscussion, the first system will be called the "core protectioncalculator" and the second system will be called the "Core OperatingLimit Supervisory System" (COLSS). The teaching which is required for anunderstanding of the mathematical derivations of some of the inputs tothese two systems is to be found in the "Appendix to the Description ofthe Preferred Embodiment".

SUMMARY OF THE INVENTION

The instant invention involves a protection apparatus and method whosefunction it is to ensure the safe operation of a nuclear reactor. Inorder to achieve safe operation of a nuclear reactor, the reactor andits collateral systems must be operated so as to avoid the violation ofcertain safety design limits. This involves not only avoiding the actualviolation of these design limits when operating on a steady-state basisbut also operating the system in such a manner as to avoid design limitviolation on the occurrence of an incident of the type which is expectedto occur at least once in the life of the system. Many of theseincidents occur very rapidly, for example, simultaneous loss of power toall four coolant pumps, and cause undesirable rapid approaches to thesafety design limits. It is, therefore, of utmost importance to providethe reactor system with protection means that insures that serious andrapid approaches to the various safety design limits, which would bringabout a violation of the design limits, are detected early enough toallow the initiation and completion of corrective or preventive actionbefore the design limits are violated. If the reactor and its collateralsystems are operated without this ability to detect the impendingviolation of a design limit, then it can be expected that a criticaldesign limit, such as those calculated to maintain fuel claddingintegrity, will be violated on the occurrence of one of these accidents.

The invention herein disclosed is a method and apparatus for calculatingand predicting the impending violation of a design limit if nocorrective action is taken. Various mathematical indices can be devised,such as the departure from nucleate boiling ratio (DNBR), which indicatethe proximity of the limiting conditions for the design limit inquestion, i.e., the occurrence of departure from nucleate boiling (DNB)and fuel clad overheating. A critical value of the index can be definedto be that value at which design limit violation occurs. To facilitatean understanding of this invention, the following discussion will bedescribed in terms of DNBR as the index of interest and fuel cladintegrity as the design limit which the DNBR index describes. However,it should be understood that the invention is not so limited since theapparatus and methods described for predicting DNBR are applicable toany index which can be mathematically generated from various measurableor calculable reactor parameters.

This invention involves the monitoring of the appropriate reactorparameters and continuously making calculations of DNBR from thoseparameters. The calculation involved is a lengthy one and must be madeperiodically on the order of every two seconds, so if a responsive DNBRis to be obtained, it is necessary to provide a nearly instantaneousupdate to the last complete calculation of DNBR. This is done bycontinuously comparing the value of each one of the parameters last usedin the last complete calculation of DNBR to the value of that parameterthat exists at the present time. This comparision produces a change inthat individual parameter. Each increment of change of each particularparameter is multiplied by a value which is a conservative estimate ofchange of DNBR which can be attributed to the change in that parameter.A like procedure is carried out for all parameters necessary tocalculate DNBR to obtain a multiplicity of changes in DNBR resultingfrom the changes in each parameter. These changes in DNBR are then addedto obtain a net change in DNBR that has occurred since the beginning ofthe calculation due to the changes in all of the parameters needed tocalculate the DNBR. The net change in DNBR is then added to the lastcompletely calculated value of DNBR, thereby generating an updated DNBRwhich is continuously responsive to the effects of the instantaneouschanges of each parameter. Coolant flow rate, neutron flux power andcoolant pressure are examples of parameters effected by a systemincident and which bring about rapid changes in DNBR.

It is not sufficient merely to obtain an updated value of DNBR at eachinstant in order to avoid violation of DNBR, since the occurrence of anincident may cause limit violation even if operating conditions wereacceptable prior to the accident. In other words, the incident may bringabout such rapid changes of operating conditions that there is notsufficient time to recognize that an incident has occurred and stillavoid a limit violation. Therefore, the protection system must have thecapability of monitoring the appropriate parameters and of predictingwhat the DNBR index value will be a certain period of time into thefuture. The specific period of time is that period of time that isrequired to insititute and complete effective protective action on thereactor after the incident has occurred and before the design limit isviolated. This period of time is essentially the reaction time of theprotective equipment and in most cases will be of constant magnitudedependent upon the characteristics of the equipment involved in thecalculation and control steps.

This invention, therefore, further includes the monitoring of variousparameters and the prediction of a future DNBR on the basis of thebehavior of the parameters monitored. This is done by continuouslydetecting the rate of change of the parameter (i.e., the slope on a plotof parameter magnitude vs. time) and multiplying that rate of change ofparameter value by the pre-selected time period (T). This gives a valueof the amount that the parameter will have changed (assuming that therate of change of the parameter remains the same) after the time period(T). Next, this value of change in parameter is multiplied by a valuewhich converts the change in parameter into a value indicative of changeof DNBR due to the change of that parameter. The value by which thechange of the parameter is multiplied is the partial derivative of DNBRwith respect to the parameter in question. This change in DNBR, which isthe projected change in DNBR over the time period (T) expected from therate of change of the parameter in question, is then added to thecontinuously updated value of DNBR calculated above to give a projectionof DNBR over the time period T. By knowing this projected DNBR, acomparison can be made to the critical value of the DNBR index. When theprojected index passes through the critical value of index, protectionmeasures can be initiated with the assurance that a time period ofduration T is available to correct the conditions and to avoid thedesign limit violation.

By following the above outlined method the situation may arise, due tothe sensitive dependence of the index on one of the parameters and dueto the possible inaccuracies in the calculation of the updated index, inwhich the originally monitored parameter undergoes variations that wouldlead the protective system into falsely believing that a design limitwill be violated. Thus, it is desirable to provide a desensitizing meanswithout sacrificing any of the protective system's capability to detectan accident and predict the impending violation of a design limit. Sucha means and method are provided by the invention and will be hereinafterdescribed.

The desensitizing method depends on the fact that the nuclear reactorshould be operated in accordance with an index (e.g., DNBR) which isseparated from the critical value of the index by some margin. If thiswere not the case, i.e., if there were no restrictions placed on theapproach of the operating index to the critical value of the index, thenthe protection system would be unable to avoid violation of the criticalvalue of the index on the occurrence of an accident, regardless of itsprediction abilities. Therefore, a certain minimum operating margin mustbe maintained. The desensitizing method takes credit for the maintenanceof this margin by selecting the higher of: the updated index calculatedfrom the actual parameters; and an updated index whose calculationderives from a false or limit index which assures the maintenance of anoperating margin. After making this selection, the predicted change ofthe index obtained as described above is added to the higher value toget the predicted index T-seconds into the future. The method forobtaining an updated value of the index based on the index incorporatingsome operating margin is as follows.

The long term average value of the parameter in question is obtained byintegrating the parameter with respect to time, and dividing by the timeperiod over which the integration was taken. Next, the instantaneousvalue of the parameter is compared to the long term average value toobtain the deviation of the parameter from the long term average value.The value thus obtained is then constrained to be equal to or lesslimiting on DNBR than the instantaneous value of the parameter inquestion. This step generates a constrained electrical signal which isnever permitted to represent a condition which would be indicative of anindex which is less favorable than the index which would be derived fromthe instantaneous value of the parameter. This deviation or change inparameter is then converted into a value which is equivalent to thechange in index due to the change in the parameter by multiplying thedeviation by the partial derivative of the index with respect to theparameter in question. The change in index thus obtained is then addedto the value of index which incorporates the margin discussed above, theresults being an instantaneously updated value of the index containingsaid margin. This value is then compared to the other continuouslyupdated value of index computed from the parameters as described above,and the higher value of the two selected for subsequent use.

The subsequent use includes the addition to the selected higher value ofthe predicted change in the index due to the projected change in theparameter over the projected time T also described above. The net resultis the derivation of a projection of index (DNBR) which is calculatedeither from the computed value of index or from the value of indexcontaining the operating margin, whichever is higher, thereby takingadvantage of the operating margin and thereby desensitizing theprojection of the index.

DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagrammatical representation of a pressurized water reactorand its collateral systems.

FIG. 2 is a plot of the decay in the primary coolant mass flow rate onthe occurrence of an accident which interrupts electrical power to allof the primary coolant pumps.

FIG. 3 is a plot of the corresponding decay in the DNBR index due to thedecay in the primary coolant mass flow rate on the occurrence of anaccident which interrupts electrical power to all of the primary coolantpumps.

FIG. 4 is a plot of the desirable behavior of the DNBR index achievedthrough the successful initiation and completion of corrective action onthe occurrence of an accident which interrupts electrical power to allof the primary coolant pumps.

FIG. 5 is a plot of the behavior of the decay of DNBR index on theoccurrence of a loss of coolant flow accident for two different axialpower shapes.

FIG. 6 is a block diagram of the core protection calculator.

FIG. 6a is a block diagram of a second embodiment of the core protectioncalculator.

FIG. 7 is a chart illustrative of axial shape index as obtained from theaxial power distribution.

FIG. 8 is a plot of axial shape index versus T where T is the time overwhich the core protection calculator makes its predictions. This plotshows one possible functional relationship between axial shape index andT.

FIG. 9 is a block diagram of calculations which must be made to obtainthe inputs of the core protection calculator. FIG. 9 is included as avisual aid for a better understanding of the mathematical definitionsand derivations found in the "Appendix to the Description of thePreferred Embodiment".

FIG. 10 is a block diagram of the core operating limit supervisorysystem (COLSS) with a modification made to the coolant mass flow rateinput signal.

FIG. 10a is a block diagram of the COLSS with a modification made to theDNBR setpoint.

FIG. 10b is a block diagram of COLSS with a modification made to thecalculated power.

FIG. 11 is a functional chart description of the derivation of the axialpower distribution and integral radial peaking factors from the absoluteaxial power distribution and from the absolute axial power distributionfor a pseudo "hottest" pin or channel.

FIG. 11a is a diagrammatic representation of a core which has beensliced into slices of thickness d_(z), indicating the positions of thehottest pin in each slice.

FIG. 11b is a diagrammatic representation of the pseudo hottest orlimiting pin obtained by stacking all of hottest pins for each sliceinto a single psuedo pin extending through all of the slices.

DESCRIPTION OF THE PREFERRED EMBODIMENT

In the art of reactor control the objectives to be achieved are themaximization of plant capacity and availability without violating thespecified acceptable fuel design limits as a result of normal operationand anticipated operational occurrences. These limits are defined toprovide a high degree of assurance that the fuel cladding integrity ismaintained.

Each of the design limits can be formulated in a mathematicaldescription which gives an indication of the proximity to the violationof the design limit. These indices are mathematically dependent upon thevarious reactor parameters. One such index is the Departure fromNucleate Boiling Ratio (DNBR) which is indicative of the probability ofoccurrence of Departure from Nucleate Boiling (DNB), For each index acritical value of index may be determined which indicates when theprobability is acceptably low that a reactor design limit is violated.In the case of DNBR the critical value has been determined to be 1.3.The DNBR index is functionally dependent upon the reactor parameters ofcoolant mass flow rate, coolant pressure, coolant inlet temperature,reactor power and reactor power distribution. The reactor must beoperated in such a way that the critical values of each index are notviolated in either of two cases: (1) steady state operation and (2) inthe event of the occurrence of an anticipated operational occurrencewhich affects the values of the parameters on which the index isdependent.

For the purposes of this description of the preferred embodiment,discussion will focus on the index called DNBR and the dependence ofDNBR on the reactor parameter of reactor coolant mass flow rate. Thischoice has been made because the one most rapid anticipated operationaloccurrence that can occur in the operation of a pressurized waterreactor is the simultaneous loss of power to all reactor coolant pumps.Other anticipated operational occurrences can occur that affect eitherthe coolant mass flow rate or the other parameters but these otherincidents result in a less rapid change in the DNBR. Therefore, theapproach to the critical value of DNBR is less rapid and more time isavailable for initiation of protective measures. If a reactor protectionsystem is devised to adequately handle the most rapid anticipatedoperational occurrence, then, by definition, its dynamic performance isadequate to accommodate the slower anticipated operational occurrences.

For a better understanding of the dependence of DNBR on coolant flowrate, refer to FIGS. 2 and 3. FIG. 2 is a plot of the decay in thereactor coolant mass flow rate on the occurrence of an incident whichinterrupts electrical power to all of the reactor coolant pumps.Examination of the plot of FIG. 2 shows that the incident occurs at timet₀ and the mass flow rate shows an exponential decay from the steadystate condition existing before the occurrence of the incident. FIG. 3shows the rapid fall in DNBR for two situations. The first situation isone in which the steady state operation before the accident was suchthat the initial value of DNBR was slightly above the critical value of1.3. In this case the DNBR falls almost immediately below the criticalvalue, indicating that the probability of damage to the fuel cladding ishigher than desired. In the second situation, the operation of thereactor prior to the incident resulted in a steady state DNBR ofapproximately 1.8. On the occurrence of the incident, the value of DNBRdrops rapidly toward the critical value of 1.3. Unlike the firstsituation, in which the critical value was almost immediately violated,the second situation will bring about a violation of the critical valueof DNBR only after a certain time period. It can be seen from these twodescribed situations that operation of the reactor with an initialmargin to the critical value of DNBR is preferable since a period oftime is available for the sensing and calculating of the occurrence ofthe accident and the initiation and completion of the correctivemeasures (reactor scram).

FIG. 4 shows the dependence of DNBR in the two situations describedabove including the effect of the actions of a protection system whichdetects the fall of coolant flow rate and which initiates a reactorscram. It can be seen in the second situation which starts from a DNBRvalue of 1.8, that due to the time delay between the time of occurrenceof the incident and the time at which the DNBR violates the criticalvalue, the protection apparatus has sufficient time to terminate thedecrease in DNBR before the critical value of DNBR is violated. Such isnot the case for the first situation and the critical value of DNBR isviolated regardless of the initiation of protective action.

A further modification to these concepts is necessary since the timeavailable for preventing limit violation depends upon the powerconfiguration within the reactor core. The reactor is controlled byinserting neutron absorbing control rods into the core from the top. Ifthe power distribution in the core is such that a power peak is near thetop of the core, control rod insertion effects are felt earlier than ifthe power was peaked in the bottom of the core. This phenomenon isreflected in FIG. 5. The lower curve illustrates the behavior of DNBRfor the case in which the power is peaked toward the top of the core.The upper curve shows the behavior of DNBR where the power is peakedtoward the bottom of the core. The minimum DNBR in both cases is 1.3;however, the curve for the case where power is peaked toward the bottomof the core starts from a slightly higher initial DNBR due to the factthat a greater time is required to halt the DNBR decrease. Therefore,the reactor should be operated either with a larger initial DNBR marginwhen the power is peaked in the bottom of the core, or the reactorprotection system should initiate control action at an earlier time thanin the case where the power is peaked in the top of the core.

The instant invention provides means and methods for (1) maintaining amargin sufficient to avoid the violation of the critical value of theindex on the occurrence of the most rapid anticipated operationaloccurrence and (2) predicting the imminent violation of the criticalvalue of the index in sufficient time to allow the initiation andcompletion of successful control measures. FIG. 1 shows a typicalpressurized reactor steam generating system with the inclusion of themargin maintaining system 60 and the protecting and predicting system58. The reactor 10 consists of a core 12 and control rods 14 (only oneof which is shown) which are movable into the core for reactor control.The core is constructed of a multitude of fuel pins 20 (only a few ofwhich are shown) which define coolant channels 22 through which thecoolant is circulated. The reactor coolant system 25 has a number ofcoolant loops only one of which is shown and which includes a hot leg 28which delivers the heated reactor coolant to a steam generator 26. Heatfrom the heated reactor coolant is transferred to the secondary coolantin the steam generator 26 to form steam which is contained in asecondary coolant system 40. The steam is delivered to a turbine 42which converts the thermal energy of the steam into mechanical rotationfor subsequent conversion into electrical energy in a generator. Thesecondary coolant, after passing through the turbine, is delivered to acondenser 44 and recirculated by feed water pumps 46 back to the steamgenerator where it again picks up heat energy from the reactor coolant.After passing through the steam generator 26, the reactor coolant iscirculated back to the reactor by reactor coolant pumps 32 and throughcold leg 34. A pressurizing system (not shown) is provided to maintainthe pressure of the primary coolant within certain acceptable limits.After being delivered to the reactor pressure vessel through the coldleg 34, the coolant is forced to circulate downwardly around the outsideof the core 12 and upwardly through the interior of the core, throughcoolant channels 22, where the reactor coolant cools the core and itsfuel pins 20.

Proper control of the nuclear reactor system requires the sensing of allthose parameters necessary for a computation of the various design limitindices. Ex-core detectors 16 are provided to monitor the neutron fluxoriginating in the reactor core. Such ex-core detectors areconventional, commercially available pieces of equipment such asmanufactured by Reuter Stokes, Inc. of Westinghouse Electric Corp.,Electronic Tube Division and the particular construction does not form apart of the invention. Also provided are strings of in-core detectors 18for monitoring the local power of individual sectors of the reactorcore. Such in-core detectors are conventional, commercially availablepieces of equipment such as manufactured by Reuter Stokes Canada Ltd.and the particular construction does not form a part of the presentinvention. Information from the in-core detectors is necessary for thecalculation of azimuthal tilt magnitude and is also used to calculatethe axial power distribution. Resistance temperature detectors 36 and 38are provided on the hot leg 28 and the cold leg 34 respectively togenerate signals indicative of the temperature of the coolant as itenters the core and as it leaves the core. These temperatures aresubsequently used in a calculation of ΔT and average temperature forcalculation purposes in determining core thermal power. The temperatureof the cold leg T_(c) is also used in a calculation of DNBR.

Shaft speed detector 50 is positioned on the rotating shaft of theprimary coolant pump 32 for the purposes of determining the speed ofrotation (W) of the coolant pump shaft which can be used to calculatethe coolant mass flow rate. Additional information is obtained bypressure sensors 51 and 53 which enable the calculation of the pressurehead across the coolant pump. This information enables a more directcalculation of coolant mass flow rate. Also provided is a pressuresensor 48 to give an indication of the reactor coolant system pressure.Turbine 42 has a pressure sensor 56 which gives an indication of theturbine first stage pressure for the purposes of calculating a totalplant power. The method for calculating total plant power from a plantload signal (turbine first stage pressure) is fully and completelydisclosed in U.S. Pat. No. 3,423,285 issued on Jan. 21, 1969 to C. F.Curry, et al, the disclosure of which is incorporated herein byreference. In addition to the turbine first stage pressure sensor 56,the secondary coolant system is equipped with mainstream pressure sensor43, feedwater temperature detector 45 and feedwater flow detector 47.

The reactor 10 and its control rods 14 are provided with a rod positiondetection system 54. This system is composed of two or more reed switchassemblies positioned adjacent to and outside of each control rodhousing 52 that extends external to the reactor pressure vessel. Thereed switches 54 are activated through the control rod housing which ismade of magnetically permeable material, by a permanent magnet affixedto a control rod extension shaft. By this means the position of everycontrol rod can be redundantly determined and logged for the purposes ofdetermining various factors to be used in the calculation of DNBR andlocal power density. More specifically, CEA group position signals andCEA deviation signals are used to calculate pin and channel planarradial peaking factors (see infra.).

All of the various signals described above which describe variousreactor parameters are delivered to either the calculation means 58called the core protection calculator, the calculation means calledCOLSS 60, or both. The parametric signals generated for and utilized bythe core protection calculator and COLSS are quite similar althoughminor differences exist. These differences in detail are differenceswhich would be obvious to one skilled in the art of reactor control.Therefore, for the sake of simplification and clarity, FIG. 1 shows thesame signals delivered to both the Core Protection Calculator 58 andCOLSS 60. However, it should be understood that in actual practice thesignals delivered to these two systems are derived from separateisolated sources. It should also be recognized that in order to meetprotection criteria, the core protection calculator must be redundantwith redundant input signals. The calculation means 58 and 60 may eitherbe hard-wired analogue systems or special purpose digital computers. Thecore protection calculator calculates and projects a value of DNBR overa certain time period T. Similar calculations and predictions can alsobe made for other design limits according to this invention. The coreprotection calculator then compares the calculated and projected valueof DNBR to a fixed setpoint indicative of the violation of the specifiedacceptable fuel design limit on DNBR. When the calculated and projectedvalue of DNBR is equal to or falls below the fixed setpoint, a signal isgenerated by the core protection calculator 58 and is sent to thecontrol rod control means 62 for the purposes of scramming the controlrods 14 into the core thereby terminating the chain reaction within thereactor core.

Some of the variously generated signals representing the reactorparameters described above are also delivered to a calculation means 60called the Core Operating Limit Supervisory System (COLSS). It is thefunction of COLSS 60 to make a very accurate calculation of a DNBRoperating limit which contains sufficient margin to allow the coreprotection calculator to sense, calculate, predict and shut the reactordown in a timely fashion that avoids the violation of any fuel designlimits. The operating limit thus generated may be utilized in either oftwo fashions in order to control the operation of the reactor. The firstis merely to register the limit on a visual indicator 170 which wouldallow the reactor operator to compare the actual reactor operatingcondition of the COLSS limit. With this knowledge available to theoperator, he will be able to operate the reactor in such a way that asufficient margin is continuously maintained while at the same timemaximizing the capability and availability of the reactor. The secondmethod would be to automatically restrict the plant power to be withinthe COLSS limit thereby insuring that the necessary margin ismaintained.

Core Protection Calculator

The low DNBR and high local power density trips initiated by a pluralityof Core Protection Calculators of which only one is shown (see FIGS. 6and 6a) funtion to assure that specified acceptable fuel design limitsare not exceeded during anticipated operational occurrences (which aredefined as those conditions of normal operation which are expected tooccur one or more times during the life of a nuclear power plant). Inparticular, these occurrences include single electrical component orcontrol system failures, that can result in transients which could leadto a violation of specified acceptable fuel design limits if protectiveaction were not initiated.

The protection system is designed so that reactor core protective actionwill not be initiated during normal operation of the reactor. Fourmeasurement channels are provided for each parameter monitored by thesystem. The four measurement channels are independent and isolated fromeach other as are the core protection calculators. These four channelsprovide trip signals to six independent logic matrices, arranged toeffect a two-out-of-four coincidence logic or a two-out-of-threecoincidence logic. This redundancy enables one of the four measurementand calculation channels to be taken out of service for maintenance ortesting while still providing the necessary protective function for theoperating reactor. In this case, the protection system logic is chargedto a two-out-of-three coincidence logic for the actuation of plantprotection action. It should be understood that this discussion and thefunctional block diagram of FIG. 6 describe only one out of the fourparallel and independent protective channels.

For the purposes of illustrating the invention and for the purpose ofteaching a preferred mode of operation, attention will be focused on thetwo fuel design limits called:

1. A 1.3 Departure from Nucleate Boiling Ratio (DNBR) in the limitingcoolant channel in the core, and

2. The peak local power density in the limiting fuel pin in the core.

The low DNBR trip maintains the integrity of the DNBR fuel design limitand the high local power density trip maintains the integrity of thefuel design limit on peak local power density. While discussion will befocused on these two indices, it should be apparent that the inventionis not so limited and applies to any design limits which may berepresented by a mathematical index.

The subject trips monitor all the Nuclear Steam Supply System parametersthat affect these fuel design limits. The pertinent parameters aremonitored directly where possible, or indirectly by monitoring NuclearSteam Supply System variables that can be related to the particularparameters of interest through well defined mathematical relationships.The number and location of sensors are chosen to assure that the reactorcore is adequately monitored for all allowable operating configurations.The parameters of primary importance for the calculation of DNBR andlocal power density are the following.

1. Reactor Core Power;

2. Reactor Core Power Distribution;

3. Reactor Coolant Flow Rate;

4. Reactor Coolant System Pressure; and

5. Reactor Coolant Inlet Temperature.

Several methods of calculation are possible and it is not intended thatthis invention be limited to any particular mathematical expression ofthe parameters used to calculate true DNBR or local power density or anyother index. The discussion following is only intended to distinctly setout and describe one mode of practicing this invention. In the spirit ofthe foregoing statement, it should be recognized that there are variousmethods for determining the controlling parameters in the "hottest" pinor the "hottest" channel of the reactor core.

One extreme method is to make calculations for each and every pin andchannel in the core. A comparison of the calculations for each and everypin and channel would determine which pin and which channel are limitingfor the operation of the reactor. A simplification of this extrememethod is to take representative samples throughout the core and makeconservative approximations that assure that the selected samplingmethod does not overlook the "hottest" or limiting pin or channel.Either of these methods is tedious and expensive to implement. Analternative method, the one to be described in this discussion, consistsof making one calculation to synthesize a psuedo "hottest" or limitingpin or channel which, by making conservative assumptions, ensures thatno actual pin or channel can exceed the conditions calculated for thepseudo limiting pin or channel.

A brief mathematical description of this method of synthesizing a pseudopin or channel follows with a detailed description of the terms andmethods used in obtaining the various parameters included in the"Appendix to the Description of the Preferred Embodiment". For a betterunderstanding of the following brief description reference may be madeto FIG. 11.

In order to calculate DNBR and the KW/ft. local power density limits,the reactor core power distribution must be known. In actuality, themethod for finding the absolute power distribution for one pin orchannel requires the subdivision of the reactor core into itsconstituent parts of individual fuel pins and coolant channels.Therefore, the function to be calculated is "the absolute powerdistributions for the limiting pseudo pin or channel" which is afunction varying with axial position along the channels (see 108 in FIG.11). In the interest of simplification, the following discussion willrefer only to the channel and not make reference to the associated fuelpin. Mathematically, this term, the channel absolute power distribution108, can be factored into three independent terms, two of which areconstants, and one of which is a function dependent on axial position orthe z coordinate. The function term is defined to be "the normalizedchannel axial power distribution" 110. This function can be thought ofas a curve indicative of power which begins at the bottom of the core(z=0) and ends at the top of the core (z=1). Every value of thisfunction, the normalized channel axial power distribution 110, or everypart of the curve generated by this function is called a "channel axialpeaking factor". The one point on the curve generated by the functionwhich represents the point of maximum power generation is called "thechannel axial peaking factor" 111.

The constant terms factored out of the "channel absolute powerdistribution" are selected to normalized the axial power distributioncurve 110 or, restated, the constant terms are chosen so that theintegration of the "channel axial power distribution" 110 from thebottom of the core (z=0) to the top of the core (z=1) gives a value ofunity. The two constants which have been factored out of the "channelabsolute power distribution" to give the "normalized channel axial powerdistribution" are called the "integral radial peaking factor" 112 andthe "total power generated in the average channel" 114. The "integralradial peaking factor" 112 is defined to be the ratio of the powergenerated in the referenced channel to the power generated in theaverage core channel.

In order to synthesize the limiting pseudo channel, a method isdeveloped for generating a "pseudo absolute power distribution for apseudo channel" 106. In order to mathematically do this, the core isthought of as being a right cylindrical solid which has been dividedinto slices along the z axis with each slice having a thickness of dz(see FIGS. 11a and 11b). This mathematical manipulation allows eachslice to be treated as a two-dimensional mode; the core, therefore,comprises a simple summation of all of the two-dimensional slices. Foreach slice a ratio of the power of the "hottest" pin in that slice tothe average power of all of the pins in that slice is generated. (SeeFIG. 11a.) This ratio is called the "planar radial peaking factor". The"planar radial peaking factor" is analogous to the "channel axialpeaking factor" discussed above for a single channel with the exceptionthat there exists one "planar radial peaking factor" for each slice. Ifall of the planar radial peaking factors for all of the slices ofthickness dz are plotted on a curve, thereby melding the "hottest" pinsin each slice into a single pseudo pin (see FIG. 11b), the result is astep curve which varies with axial position 102. The step function 102generated by the "planar radial peaking factors" may be multiplied bythe "core average axial power distribution" 100 which is a z dependentfunction and the "average over all slices of average pin power perslice" 104, which is a constant for one set of reactor operatingconditions. This former term, the core average axial power distribution,is a cross-plot of the linear power density in each axial slice versusthe axial position of the slice, with appropriate normalization suchthat integration of the curve from z=0 to z=1 gives a value of unity.This latter term, the "average over all slices of average pin power perslice" 104 is a number proportional to the total power generated in thecore. The function which results from the multiplication of the functiongenerated by the "planar radial peaking factors" 102, the "core averageaxial power distribution" 100 and the "average over all slices ofaverage pin power per slice" 104 is the "pseudo absolute powerdistribution for the pseudo limiting pin or channel" 106.

In this way a pseudo pin can be generated representing the worstpossible power distribution or the power distribution for the limitingpin, since the hottest pins in each slice have been stacked into onepseudo pin extending through all of the slices (see FIG. 11b). Once this"pseudo absolute power distribution for the pseudo limiting pin" 106 hasbeen generated, it may then be factored into a normalized axial powerdistribution 110 and an integral radial peaking factor 112 for thepseudo limiting pin just as in the case for an actual pin. The purposeof mixing these calculations is to obtain a normalized axial powerdistribution F_(z) (z) and an integral radial peaking factor F_(r) whichare two of the input signals necessary for the calculation of the DNBRindex and the KW/ft. local power density index according to functionalequations (1) and (2) which appear in the "Background of the Invention".The above concepts are discussed in greater detail in the "Appendix tothe Description of the Preferred Embodiment".

Referring now to FIG. 6, the method used by the core protectioncalculator will be described. A calculation of DNBR is made infunctional element 76 according to the equation:

    DNBR=f(φ, m, P, T.sub.c, F.sub.z (z), F.sub.r, T.sub.r)

where

φ=core power,

m=coolant mass flow rate;

P=reactor coolant system pressure;

T_(c) =cold leg temperature;

F_(z) (z)=axial power distribution;

F_(r) =integral radial peaking factor; and

T_(r) =azimuthal tilt magnitude. An explanation of φ, F_(z) (z), F_(r)and T_(r) is to be found in detail in the "Appendix to the Descriptionof the Preferred Embodiment."

The signals are monitored by the DNBR calculated 76 and a snapshot istaken of these signals approximately every two seconds. The snapshotvalues are used in a calculation of DNBR which takes approximately 2seconds. The two to four second old indication of DNBR which results isnot sufficiently responsive to the actual condition in the reactor coreto allow adequate core protection; therefore, means are provided forcontinuously updating this basic DNBR calculation. For the purposes ofthis discussion and claims, the word "continuously" should be taken tomean "of a periodicity which is substantially higher than the frequencyof the periodic calculation". The values of each of the parameters usedin the most recently completed periodic snapshot calculation of DNBR arecompared at 78 with the continuously monitored parameters. Thiscomparison results in an update change in parameter for each of theparameters used in the DNBR calculation of element 76. Element 78 thenmultiplies each change of parameter by a value which conservativelyconverts each change of parameter into a change of DNBR. An example ofthe type of multiplication which may be made is the multiplication ofchange in temperature by a value which is equivalent to the partialderivative of the DNBR equation with respect to temperature. The partialderivative may either be taken to be a constant value or it may be takento be a function which is dependent upon all other parameters except T,the choice depending upon which multiplication gives a more satisfactoryresult. After element 78 generates a change in DNBR for the change ineach parameter, all of the changes in DNBR are summed to obtain a netchange in DNBR. This net change in DNBR and the snapshot calculation ofDNBR are added in element 80, the result being a continuously updatedvalue of DNBR which is dynamically responsive to changes in the reactorcore.

The above described calculation standing alone is not sufficient for thefunction of protecting the reactor core. The reason for this is that itis not sufficient merely to know what the DNBR is but it is necessary tobe able to predict what the DNBR will be far enough in advance to allowthe initiation and completion of corrective action that will avoid limitviolation. Therefore, a projection of DNBR must be made. The projectionis accomplished by elements 82, 84 and 86 of the Core ProtectionCalculator. These elements sense the dynamic response of one of thereactor parameters and take the slope or the rate of change of theparameter with respect to time. This slope or rate of chage is thenprojected over a period of time T. In this manner, a projection ofchange of DNBR may be calculated on the basis of the instantaneous rateof change of one of the reactor parameters. Projections of the rate ofchange of each parameter are continuously made, thereby providing acontinuous projection of change of DNBR. Now, referring to FIG. 6element 82 takes the derivative of the parameter, for example pressure,with respect to time. Element 84 then multiplies the derivative of thesignal with respect to time by a value which is proportional to thepartial derivative of DNBR with respect to the parameter beingprojected. The product of these two terms is a term indicative of thechange in DNBR with respect to time due to the change in the parameterin question. This change in DNBR with respect to time is then multipliedby a time period T_(p) to obtain a projected change in DNBR. The timeperiod over which the change in DNBR is projected is a period which iscalculated to allow the sensing, calculating and predicting of a limitviolation and to allow the initiation and completion of correctiveaction before the violation of a design limit all of which representsystem inertia or system reaction time. The time period T is illustratedin FIG. 2. It should be recognized from FIG. 5 and from the discussionabove that the multiplicative time period T may have to be modifieddepending upon the power distribution within the core.

The projected change in DNBR which has been derived by elements 82, 84and 86 is then limited to negative values in element 88 before it issummed in element 90 with the calculated value of DNBR of element 80.

A calculation similar to the one which has just been described may bemade for any of the reactor parameters on which DNBR depends. In actualoperation, it is likely that the dynamic response of DNBR to changes incoolant temperature, axial power distribution, integral radial powerdistribution, and azimuthal tilt magnitude will not be fast enough torequire the projection techniques just described. However, it is likelythat the parameters of core power, reactor coolant system pressure andcoolant mass flow rate will be projected as above since DNBR is veryresponsive to changes in these parameters.

It is indeed likely that DNBR will be so responsive to changes incoolant mass flow rate that a technique for desensitizing the DNBRresponse should be provided in order to avoid unnecessary reactor trips.In order to do this, the core protection calculator may take advantageof the presence of a system similar to COLSS which insures that anappropriate margin to the fuel design limit will be maintained. It is acharacteristic of the COLSS system that it need not be as dynamicallyresponsive to changes in reactor parameters as the core protectioncalculator since COLSS assures that adequate margin is maintained tofuel design limits only during normal operation. The core protectioncalculator, on the other hand, must be dynamically responsive to changesin reactor parameters in order to adequately protect the reactor coreduring anticipated operational occurrences. The differences betweenthese two systems mandate an extremely fast, although approximate, coreprotection calculation of DNBR and predicted DNBR, and a slower butextremely accurate COLSS DNBR calculation. Therefore, it is apossibility that the approximations made to allow a rapid and dynamiccalculation of DNBR in the core protection calculator may result in avalue of DNBR that is less accurate than the values of DNBR calculatedby COLSS. Advantage may be taken of these calculational differences toprovide a method to desensitize the responses of the core protectioncalculator value of DNBR to changes in the coolant mass flow rate.

A brief description of this desensitization process follows. The DNBRvalue calculated by COLSS which includes an operating margin is used asthe static base value of DNBR to which continuous instantaneousmodifications are made rather than that value of DNBR which isperiodically calculated by the core protection calculator. This statisbase value of DNBR called DNBR_(limit) is then updated to make itresponsive to changes in coolant mass flow rate to obtain an updatedvalue of DNBR. This updated value of DNBR is then compared to theupdated values of DNBR obtained from the above-described periodiccalculation and the higher of the two values is selected. To this highervalue is added a projected change in DNBR which is obtained in aprojection procedure similar to that described above for a projection ofprimary pressure.

Reactor coolant pump speed signals (W_(i)) are continuously delivered toelement 120 along with the cold leg temperature and the reactor coolantsystem pressure where a calculation is made converting these signalsinto coolant mass flow rate signals (m₁).

FIG. 6 shows four sets of signals from the useful configuration of fourreactor coolant pumps. Element 122 sums the four mass flow rate signals(m_(i)) to produce a total coolant mass flow rate signal (m_(t)). In aseries of steps similar to the pressure signal projection sequencedescribed above, the derivative of m_(t) is taken at 124 with respect totime to get the rate of change of m_(t). This value is then multipliedby the partial derivative of DNBR with respect to the mass flow rate at126 to obtain a signal indicative of the rate of change of DNBR due tothe rate of change of the coolant mass flow rate. Next, a projection ofthe change of DNBR over a period of time T is made in element 128 bymultiplying the signal indicative of the rate of change of DNBR withrespect to time by a period of time T. Just as in the example describedabove for the projection of DNBR due to changes in pressure, the valueof T may be dependent on the axial power distribution that exists in thereactor core. Thus, element 134 generates a time period T_(fz) as afunction of axial power distribution. There are numerous acceptable waysthat element 134 can handle this function generation. A suggestedpreferred mode is illustrated in FIGS. 7 and 8. FIG. 7 is a plot ofaxial power distribution F_(z) (z) from the bottom to the top of thecore. The core is divided into two equal parts; the lower half of thecore and the upper half of the core. The axial power distribution isintegrated in element 134 over each half to get two numbers symbolizedby L and U meaning lower and upper halves. FIG. 7 represents a reactorconfiguration in which the axial power distribution is weighed moreheavily toward the bottom of the core. In such a situation the areaunder the axial power distribution curve toward the bttom of the core,L, would be larger than that at the top of the core U. By using thesetwo values, L and U, an Axial Shape Index can be generated which gives asingle number indicative of the axial power distribution. One possibleaxial shape index can be generated by the following equation:

    ASI=(L-U)/(L+U)

An examination of this equation shows that the Axial Shape Index will benegative when the power distribution is peaked toward the top of thecore, and positive when the power distribution is peaked toward thebottom of the core. FIG. 8 shows one way in which this fact may beutilized to generate a time period T which is a function of the axialpower distribution. The shape of the curve plotted with Axial ShapeIndex versus T is chosen by the reactor designers to make best use ofthe fact that it takes less time to terminate the reactor's nuclearchain reaction when the power is peaked in the top of the core. Thus,the greater the power peak in the top of the core, the larger is thenegative value of the Axial Shape Index. The curve of FIG. 8 shows thatT decreases with larger and larger negative values of Axial Shape Index.

Once the projection of change in DNBR is obtained, it is limited tonegative valves in element 130 (for the sake of being conservative) andis then added to an updated base value of DNBR in element 132. Theappropriate updated base value of DNBR is the larger of either the valuecomputed by the periodic sampling method described above and which iscomputed in elements 76, 78 and 80, or the value computed by using afixed base value of DNBR which includes an operating margin. For thesake of simplifying the discussion, this base value of DNBR, whichincludes a margin, will be called DNBR_(limit) and may be found on FIG.6 as an input to element 98. The DNBR_(limit) value is a constant thatmay be determined once the typical characteristics of the reactorprotection equipment are determined. The functioning of the COLSS marginsystem will be described, infra, following the completion of thediscussion of the core protection calculator. The inclusion of theDNBR_(limit) value as a base value for the desensitization of theresponse of DNBR to the coolant mass flow rate is justified by the factthat when the reactor is operated on the basis of the COLSS margin, asit should be when operated on a steady-state basis, then reactorconditions should always be such that this margin exists.

The DNBR_(limit) must be dynamically updated for recent changes in DNBR.The following is a description of the preferred method for accomplishingthis update. The values of m_(t) (total coolant mass flow rate) arecontinuously fed to element 92 where the following calculation is made.The mass flow rate is continuously integrated over a priod of time whichis long compared to typical transients which effect the parametric valueof mass flow rate. The value obtained from the integration iscontinuously divided by the same time period over which the integrationwas made, thereby generating an average value of coolant mass flow rateover the stated period of time (m). This flow average value (m) is thencompared in element 94 to the instantaneous value of coolant mass flowrate (m₅) to obtain a recent deviation of mass flow rate (Δm) from thelong term average value of mass flow rate. If the deviation is negative,i.e., m less than m_(t), the value of the mass flow rate integral (m) isautomatically increased such that m=m_(t). In element 96 Δm ismultiplied by the partial derivative of DNBR with respect to the coolantmass flow rate (m). The product of this multiplication is a valueindicative of any decrease in DNBR (ΔDNBR) due to any recent decrease ofcoolant mass flow rate from the long term average value of mass flowrate. The derived ΔDNBR is then used as the value which updates theDNBR_(limit) in element 98 to give an updated value of DNBR_(limit). Asignal representing DNBR_(limit) is then sent to element 118 where it iscompared to the updated DNBR value which has concurrently beencalculated in elements 76, 78 and 80. Element 118 selects the highervalue of the two updated DNBR signals to be used as the value to whichthe projected change in DNBR over time T is to be subtracted in element132 to generate a predicted value of DNBR T seconds into the future dueto a projected change in coolant mass flow rate.

At this point in this description, two values of predicted DNBR havebeen described as having been generated in elements 90 and 132. Element136 selects the lower value of all of the predicted values of DNBR andelement 138 compares that selected low value to the critical value ofDNBR (1.3). If the predicted value is equal to or less than the criticalvalue of DNBR, then a signal is sent to element 140 which generates asignal for tripping the reactor. The tripping action de-energizes theelectromagnetic circuits on a magnetic jack control rod drive mechanismand the control rods are allowed to fall into the reactor core.

A second embodiment of the core protection calculator 58 appears in FIG.6A. In this embodiment, the same signals are generated as inputs withthe exception that one or more of them are modified in element 75.Element 75 generates signals which are dynamically commensurate with theparameters that the fuel design limit is most closely related to; thesedynamically compensated signals are then projected over time T. The timeprojection technique described in the first embodiment as occurring inelements 82, 84 and 86 is thus handled by element 75. The net result ofthis modification is that elements 82, 84 and 86 have been embodied innew element 75 and the dynamic compensation and time projection is madebefore the DNBR calculation and update are made in elements 76 and 78.Thus, the DNBR calculation and update are calculations which work withat least one parameter which has been dynamically compensated andprojected into the future, resulting in a calculation of projected DNBR.

Core Operating Limit Supervisory System (COLSS)

The function of the Core Operating Limit Supervisory System is to insurethat the nuclear reactor is operated with sufficient margin to criticalcore design limits so that the Reactor Protection System has time toterminate an incident (anticipated operational occurrence) before theviolation of a fuel design limit. The method and apparatus describedherein can be adapted to calculate a limiting value of a reactorparameter which encompasses such a sufficient margin. This method isapplicable to any design limit; however, for the sake of simplification,the following discussion will be focused primarily on fuel element cladintegrity and overheating as indicated by the occurrence of departurefrom nucleate boiling and the appropriate index, DNBR.

As described above, DNBR is a function of a number of either measured orcalculated reactor parameters and may be expressed in the functionalnotation:

    DNBR=f(φ, T.sub.c, P, m, F.sub.r, F.sub.z (z), T.sub.r)

where

φ=core power in percent of full power;

T_(c) =coolant inlet temperature;

P=coolant pressure;

m=coolant mass flow rate;

F_(r) =integral radial peaking factor;

F_(z) (z)=axial power distribution; and

T_(r) =azimuthal tilt magnitude. A detailed description of how corepower, axial power distribution, integral radial peaking factors andazimuthal tilt magnitude are generated appears in the "Appendix to theDescription of the Preferred Embodiment". The critical value of DNBR is1.3 (or 1 depending on the definitions used). One possibility foroperating the reactor with a sufficiently large margin (see FIG. 4) isto make sure that the reactor is operated at a DNBR value (say 1.8)which is sufficiently distant from the critical value of 1.3 to allowenough time to sense the occurrence of an accident, predict the effectof the occurence of the accident and take appropriate protective action,such as scramming the reactor. Using this approach, the value of one ofthe parameters on which DNBR, if functionally dependent, (for example,core power) may be calculated from the above equation by using the falseinput of 1.8 for DNBR (see FIG. 10A). The result of the on-linecalculation is a false value of the parameter which is then used as anoperating limit. This calculated false parameter (power) or limit isthen displayed to the operator informing him that if he were to allowthe actual reactor power to exceed the computed false power or powerlimit, then the DNBR margin would be less than that required for theavoidance of design limit violation on the occurrence of an anticipatedoperational occurrence. At this point the operator has at least twochoices. He can cause control rods to be inserted into the reactor,thereby resisting actual reactor power until the actual power no longerexceeds the power limit, or, he can cause variations in one of the otherparameters on which DNBR is dependent, such as inlet temperature T_(c),coolant pressure P, or coolant mass flow rate m, in such a way as toraise the computed power limit (i.e., increase the existing DNBR margin)so that the actual power no longer exceeds the computed power limit.

In the above described procedure and calculation, the variables in theDNBR equation were treated in three distinct ways: (1) one variable(DNBR) was modified (from 1.3 to 1.8); (2) one variable (power) wascalculated as the unknown, the solution for which gave a limit, and (3)the remaining variables were treated as known values whose true valueswere used in the calculation of the limit on the basis of the false ormodified input. It is mathematically possible, and perhaps desirable toswitch the variables and their roles. Thus, an operating limit may becalculated for the temperature variable rather than for power. In thiscase, a temperature limit is obtained by utilizing the actual reactorpower in the calculation and then the temperature limit is compared tothe actual temperature by the operator just as in the case describedabove for the power limit and the actual power. Another way in which apower limit may be obtained is to generate as input signals the truevalues for all the variables (except power) including a DNBR signal of1.3. The calculation results in an actual power which may then bemodified to obtain an adjusted power or power limit which encompasses anoperating margin. (See FIG. 10B).

Another way in which a modification can be made to incorporate anoperating margin is the modification of one of the other variables, suchas coolant mass flow rate, rather than the DNBR inex or the power. Infact, in practical application, it turns out that the more desirablemethod is to falsify the coolant mass flow rate signal rather than theDNBR value, and to iterate on reactor power as the calculated operatinglimit. Therefore, as the preferred mode of practicing this invention,FIG. 10 illustrates the method described above with the coolant massflow rate being modified to build in a margin which is then used incalculating a core power operating limit.

Referring to FIG. 10, the inputs of feedwater temperature (T_(s)),mainstream pressure (P_(s)), feedwater flow (m_(s)), turbine first stagepressure (P_(t)), core inlet temperature (T_(c)), reactor coolant pumpspeed (W), reactor coolant pump head (ΔP), reactor coolant pressure(P_(pri)), CEA positions, and in-core flux (φ) are delivered to the coreoperating limit supervisory system (COLSS) 60. From these signals, corecalorimetric power 142, core plant power 144, coolant volumetric flowrate (m) 146, fuel pin and coolant channel planar radials (F_(r)) 148,azimuthal tilt magnitude (T_(r)) 150, and normalized axial powerdistribution F_(z) (z) 152 are computed. See U.S. Pat. No. 3,752,735entitled "Instrumentation for Nuclear Reactor" as an illustration of oneprior art technique for the derivation of core calorimetric power. SeeU.S. Pat Nos. 3,423,285 and 3,356,577, which patents are illustrative ofthe prior art techniques for computing core (plant) power from turbinefirst stage pressure and for automatically calibrating the core (plant)power to core (calorimetric) power respectively. The signals indicativeof fuel pin and coolant channel planar radials, azimuthal tilt magnitudeand normalized axial power distribution are computed as described in the"Appendix to the Description of the Preferred Embodiment". One of thetotality of generated signals is modified by a factor which iscalculated to build a margin into the operating limit to be computed.For purposes of this description, the variable chosen to be modified isthe coolant flow rate, m, as shown in element 156.

The modification made in element 156 is of the general form

    m.sub.adj =m[f(reactor condition)]

where m is the true value of the coolant flow rate and f(reactorcondition) is the modification increment which falsifies the flow rateto generate an adjusted flow rate m_(adj). One possible modificationfunction, f(reactor condition) is [+Δm/m].

The value of Δm is a value which is a function of reactor reaction timeor system inertia including delays in sensing, calculating, predictingand actuating the reactor's protection mechanisms and which also varieswith the reactor core axial power distribution similar to the way inwhich T varied in the discussion of the projected technique supra. Ifthe core power is peaked toward the top of the core, effective controlof the core's chain reaction may be accomplished in a shorter time thanif the core power were peaked in the bottom of the core. Thus, with thepeak toward the top of the core, a smaller margin is adequate to ensurethat timely control action may be taken than for the case in which thepower is peaked toward the bottom of the core. The functional dependenceof Δm on axial power distribution may be developed by using the AxialShape Index and a technique which is similar to that described for the Tdependence on axial power distribution discussed above in thedescription of the core protection calculator.

Using the signals generated from the various input parameters, includingthe adjusted coolant flow rate signal, an operating limit (φ-power) iscalculated in element 162 according to the equation:

    DNBR=f(φ, m.sub.adj, T.sub.c, P, F.sub.z (z), F.sub.r, T.sub.r).

A similar core power limit based on local power density or any otherdesign limit may also be calculated in element 158 and additionalelements (not shown) in accordance with the equation

    KW/ft.=f(Q, F.sub.z (z), F.sub.r)

or an appropriate alternative equation. A similar signal modification(not shown) could be made for this calculation.

The signals from elements 142 and 144 representing core (calorimetric)power and core (plant) power respectively are delivered to element 154where the core (plant) power is automatically calibrated to the core(calorimetric) power. The resultant signal generated by element 154 is asignal representative of the actual power of the reactor. This signal iscompared to the lowest power limit available. FIG. 10 shows threeavailable power limits, one generated in element 162 by the DNBRequation, one generated in element 158 by the KW/ft. equation and onedetermined by the licensed power limit as generated in the element 166.These three (or more) power limit signals are compared and the lowestselected in element 164 for comparison with the actual power asgenerated in element 154. If the comparison indicates that the actualpower is in violation of the power limit, then an alarm means 170 isactivated alerting the operator that remedial action is required.

Core Protection Calculator and the Core Operating Limit SupervisorySystem

The third invention herein disclosed consists of the combination of theCore Protection Calculator 58 and the Core Operating Limit SupervisorySystem (COLSS) 60. See FIG. 1, FIG. 6 and FIG. 9. The combination ofthese two systems creates a symbiotic relationship designed to protectthe nuclear reactor 10 from design limit violations, both insteady-state operation and during the transients caused by anticipatedoperational occurrences. The combination of the Core ProtectionCalculator 58 and the COLSS 60 systems takes advantage of each of theirdesign characteristics. The Core Protection Calculator 58 is aprotection device which must respond rapidly to system transients sothat safety and system design limits are not violated. This system notonly be rapidly responsive to reactor system transients, but theprotection system must also be redundant so that a single failure cannotprevent the required protective action from occurring. In order to meetthese requirements, the core protection calculator has been designed toconsist of four mini-computers, each mini-computer comprising anindependent and redundant channel. Increasing cost for increasingcomputer complexity and the need for rapid response requires the coreprotection calculator 58 mini-computers to be limited in their degree ofcalculational accuracy. The COLSS system 60, on the other hand, need notinclude either the characteristics of system redundancy or rapidresponse. Therefore, COLSS calculations may be made in a high poweredplant computer at a relatively slow rate of calculation with the highestdegree of accuracy which can possibly be achieved. As a result, theoperating limit values calcuated by COLSS are much more accurate thanthe calculations made by the core protection calculator.

By recognizing these differences, utilization of the two systems may bemade in a way that takes advantage of the strong points of each.Therefore, reactor steady-state operation is based on the slow, althoughvery accurate, operating limit calculated by COLSS. As has beendescribed above, this limit is a value which provides sufficient marginto the design limits to allow the core protection calculator to respondto an incident and terminate the reactor core chain reaction before thedesign limits are violated. Due to the inaccuracies of the coreprotection calculator and the need to provide allowances for them, thecore protection calculator will normally indicate that the reactor isrunning closer to a specified limit than would be indicated by theCOLSS. When this is the case, the reactor tripping system will beconservative and will trip the reactor before a trip is actuallyrequired. This unavoidable behavior is acceptable since it representsincreased conservatism and does not raise the potential for design limitviolation. For most efficient operation, the core protection calculatormust be made sufficiently accurate to avoid reactor trips on normalparameter fluctuations which are expected to occur during steady-stateoperation of the reactor system at the COLSS operating limit.

In the above described manner, COLSS and the core protection calculatoroperate hand-in-hand to assure the efficient and safe operation of thenuclear reactor system. The Core Protection Calculator 58 projects aheadin time a prediction of DNBR and trips the reactor when the predictedvalue is seen to violate the design limit. COLSS calculates a parametriclimit value which incorporates a margin, and on the basis of which thereactor should be operated. When both of these systems are joined incombination, the reactor can be operated in a safe and efficient manner.

While a preferred embodiment has been shown and described, variousmodifications and substitutions may be made thereto without departingfrom the spirit and scope of the present invention. Accordingly, it isto be understood that the present invention has been described by way ofillustration and not limitation.

The following "Appendix to the Description of the Preferred Embodiment"is a description of the generation of some of the input signals used inthe above described calculation. In reading the appendix, it may behelpful to refer to FIG. 9 and to FIG. 11.

Appendix to the Description of the Preferred Embodiment Methods Used toDetermine Core Power Distributions

The axial heat flux distributions in the channels 22 and the local powerdensity distributions in the fuel pins 20 are dependent upon the corepower distribution. The core power distribution can be thought of asbeing composed of three distinct components:

a. core average power;

b. normalized core average axial power distribution; and

c. normalized radial power distribution.

The method used to define the "hot" pin and "hot" channel powerdistribution consists of measuring core average power, synthesizing thenormalized core average axial power distribution from out-or-coreneutron flux signals and synthesizing the radial peaking factor from CEA14 position measurements.

Normalized Core Average Axial Power Distribution

A normalized axial flux distribution is synthesized from the response ofthe ex-core detectors 16 and corrected for shape annealing and rodshadowing in order to determine a core average normalized axial powerdistribution. The ex-core detectors 16 are sensitive to the leakageneutron flux from the reactor core 12. The neutron flux seen by each ofthe three axially positioned detectors 16 is dependent upon the axialflux distribution near the core periphery, the radial flux distributionnear the core periphery, and the diffusion and capture of neutronsleaking from the core periphery to the point of incidence with theex-core detectors 16.

Shape annealing, or the relative effect of contributions of the coreperipheral axial flux distribution to a given detector, is due to theplacement of the detector 16 away from the core periphery 12. Thedetectors "see" a distorted peripheral flux distribution due to thescattering and diffusion of neutrons between the periphery and thedetector locations. The shape annealing factors are dependent only uponthe geometric location of the detectors 16 and do no depend on the axialflux distribution.

Rod shadowing is the effect of rod insertion on the peripheral axialflux distribution relative to the core average power distribution. Rodshadowing factors are dependent upon the rods 14 inserted in the core12.

Since the ex-core detectors 16 primarily measure the flux distributionof the peripheral fuel elements 24 and since the detectors 16 arelocated a fixed distance from these elements 24, correction factors inthe form of rod shadowing and shape annealing are required to obtain thecore average axial power distribution in the core 12 from the fluxdistribution at the detectors.

Calculation of Normalized Core Average Axial Power Distribution

The method by which the normalized axial flux distribution at theex-core detectors is used to yield the normalized core average axialpower distribution is described in the following.

Let the normalized axial flux distribution at the detectors bedesignated as φ_(i) where i designates the axial node at which the fluxis defined. Let S_(ij) be the contribution of a unit flux at axial nodej at the core periphery to the flux at node i at the detector. OLetφ_(j) be the flux at the core periphery in axial node j. Thus, the fluxat the detector is given by ##EQU1## Representing the fluxes at thedetector and periphery as n element column vectors implies that

    φ=S φ

where

φ is an n element column vector whose typical element is φ_(i)representing the flux at the detector at node i.

φ is an n element column vector whose typical element is φ_(j)representing the flux at the core periphery at node j.

S is an n×n square matrix whose typical element is S_(ij) representingthe shape annealing factor for the flux at node i at the detector due tothe flux at the periphery at node j.

The flux shape at the periphery is then given by

    φ=S.sup.-1 φ

Having determined the peripheral axial flux distribution, it is nownecessary to determine the core average axial power distribution φ_(k)by correcting for control element assembly (CEA) insertion. CEA positionindications are used to generate axial CEA shadowing factors.

A planar CEA shadowing factor for a particular planar CEA configurationis defined as the ratio of the peripheral flux at an axial node havingthat planar CEA configuration to the peripheral flux at an unroddednode, given that the power in the node is the same in both cases.

When the entire node is not uniformly rodded, the planar CEA shadowingfactor for that node is given by ##EQU2## where γ_(k) is the fraction ofthe node which is rodded with the planar CEA configuration associatedwith planar CEA shadowing factor F_(k). These factors are convenientlyarranged into an n×n diagonal matrix F. The resultant correction processis mathematically defined as follows:

    φ=F.sup.-1 φ

where:

φ is an n element column vector whose typical element is φ_(k)representing the core average axial power distribution at node k.

F is an n×n diagonal matrix whose typical element is F_(kk) representingthe CEA shadowing factor associated with a CEA insertion at node k.

φ is an n element column vector whose typical element is φ_(j)representing the flux at the core periphery at node j.

Net Algorithm

The required correction algorithm for converting the ex-core axial fluxdistribution as synthesized using the ex-core detector responses to thenormalized core average axial power distribution is expressed by thefollowing matrix equation:

    φ=F.sup.-1 S.sup.-1 φ

Normalized Radial Power Distribution

The radial power distribution that exists at any time for a specifiedfuel loading pattern, fuel enrichment, and fuel burnup is dependentprimarily upon the following:

a. Location and insertion of full and part-length CEA groups;

b. The relative position of individual CEAs within the same CEA group;and

c. Azimuthal Flux tilt magnitude.

The radial power distribution will vary along the core 12 height as afunction of the CEA 14 configuration that exists in a given axialsegment. The peak value of the normalized radial power distribution in agiven axial segment is defined as the one-pin planar radial peakingfactor for that segment. The product of the one-pin planar radialpeaking factor, core average power and normalized core average axialpower distribution in an axial segment defines the power produced in the"hottest" fuel pin 20 in that axial segment.

This product also defines a quantity that is directly proportional tothe heat flux in the "hottest" channel 22 in the axial segment. Thecombination of planar radial peaking factors in axial segments havingknown CEA 14 configurations, synthesized normalized core average axialpower distribution and the measured core average power conservativelydefines the axial heat flux distribution and local power densitydistribution in the "hot" channel 22 and fuel pin 20, respectively,without consideration for azimuthal tilt. The presence of an azimuthaltilt will have the effect of increasing an "untilted" planar radialpeaking factor by an amount that is directly proportional to themagnitude of the tilt.

The core protection calculator will monitor the position of every CEAgroup and receive information from CEA Calculators on the relativeposition of CEAs 14 in the same group. This information is used todefine the CEA 14 configuration along the entire core 12 height. Knowingthe total CEA configuration, precalculated planar radial peaking factorsare chosen that apply to each axial segment. The radial peaking factorsare then modified to reflect an azimuthal tilt magnitude that is at itsworst case operating limit. This latter adjustment is made because theazimuthal tilt magnitude is not a directly monitored parameter. Theresult is a set of axially varying planar radial peaking factors thatcan be used in defining the "hot" pin and "hot" channel conditions.

Calculation of Planar Radial Peaking Factors

Planar radial peaking factors are used in conjunction with the coreaverage axial power shape to determine the three dimensional peakingfactor and the heat flux axial profile. Since the radial peaking dependsupon the number and location of control CEAs, planar radial peakingfactors depend upon CEA bank insertion and hence upon axial position inthe core. The planar radial peaking factors are determined by the CoreProtection Calculators (CPCs) for each of 25 axial nodes.

Determination of the pin planar radial peaking factors at any givenaxial node by the CPC is done by a table look-up routine using aprecalculated table of values for the planar radial associated withthose CEA groups which have been inserted in normal sequence into theaxial node of interest. Penalty factors are then applied to account forthe increased radial peaking which would result from conditions otherthan normal. These include CEA groups being inserted out of sequence,excessive misalignment of subgroups from the group average position, andexcessive misalignment of individual CEAs from its average subgroupposition.

In the discussion which follows, the term subgroup is defined as beingany one of the sets of four CEA combinations which are operated andpositioned as a unit. A group is then any combination of one or moresubgroups which are operated and positioned as a unit. Regulating CEAgroups are considered to be inserted in a prescribed sequence, withgroup withdrawal in the reverse order. Any insertion of regulatinggroups in other than this prescribed sequence is considered to be anout-of-sequence condition. In addition to the normal sequentialinsertion of regulating groups, either or both of the part length rod(PLR) groups or selected subgroups used for reactor power cutback can beinserted at the same time.

F.sub.αn is the pin planar radial peaking factor associated with theconfiguration of CEA groups identified by the αn subscript. Here nrepresents the number of regulating groups, inserted according to theirspecific sequence, and α represents the combination of PLR and/or theselected reactor power cutback subgroups inserted in addition to theregulating groups. As an example, if A represents PLR group 1, Brepresents PLR group 2, and C represents a reactor power cutbacksubgroup then the group configurations and their associated planarradials can be designated as in the following example:

    ______________________________________                                                         Subscript                                                                     Designa-  Pin planar radial                                  CEA Configuration                                                                              tion, αn                                                                          Peaking factor, F.sub.αn                     ______________________________________                                        First 3 regulating groups                                                                      3         F.sub.3                                            First 2 regulating groups                                                     + PLR group 1    A2        F.sub.A2                                           First 4 regulating groups                                                     + cutback group  C4        F.sub.C4                                           PLR group 2 only, no                                                          regulating groups                                                                              B0        F.sub.B0                                           First regulating group + both                                                 PLR groups + cutback group.                                                                    ABCl      F.sub.ABCl                                         ______________________________________                                    

The information available for calculating the planar radials includesthe position of a target CEA in each of the 22 subgroups, and CEAdeviation information identifying the CEA with maximum deviation fromthe average position of the CEAs making up the subgroup and themagnitude and direction of the deviation.

The sequence of steps by which the planar radial peaking factors aredetermined is as follows:

In the first step, target CEA positions and CEA deviations are used asinputs in a calculation where subgroup position is determined. Thesubgroup position is taken to be the target CEA position, unless thetarget CEA is the one identified as deviating from the group average. Inthat case the indicated position is adjusted by the amount of thedeviation to give the subgroup position.

Subgroup position is used as input to step two, where the averageposition of those subgroups making up a group is taken to get the groupposition. Group position and subgroup position is used as input to stepthree, where subgroup deviation from group position is obtained.

The group position from step two is also input to step four where pinplanar radial peaking factors for normal CEA sequencing are determined.For each of the 25 axial nodes in the core, the group position signalsare used to determine which CEA groups have been inserted in theirnormal sequence into that node. The appropriate pin planar radialpeaking factor, F.sub.αn, associated with that CEA configuration is thenobtained from a precalculated tableof peaking factors.

In the fifth step, the group position information is evaluated at eachaxial node to determine whether any CEA groups are inserted into a nodeother than those of which follow the normal sequence of insertion. If anout-of-sequence condition exceeds the allowable limits, anout-of-sequence penalty factor, P_(os), is applied to the planar radial,F.sub.αn, at the nodes affected.

In steps six and seven additional penalty factors, P_(s) and P_(r), areapplied to account for subgroup or CEA deviations in excess of theallowable limits. Group position is evaluated to identify those nodes atwhich the group insertion terminates. If subgroup or CEA deviationexceeds the allowable limits, then the appropriate penalty factor isapplied at the nodes affected. As might be expected, the penalty factorshave different values depending on the direction of the deviation.

The product F.sub.αn P_(os) P_(s) P_(r) emerging from step seven is thenodewise pin planar radial peaking factor, F_(r) ^(p) (z). The pinplanar radial peaking factor is used in the high local power density setpoint and DNBR calculation. The channel planar radial peaking factor(F_(r) ^(CHAN) (z)) is used on the DNBR calculation and is related tothe pin planar radial by a proportionality constant. The algorithm issummarized below.

Algorithm For Planar Radial Peaking Factor Calculation Definitions

D_(rj) --the maximum deviation of an individual CEA in subgroup j fromthe subgroup position.

D_(si) --the maximum deviation of the subgroup in group i from the groupposition.

F_(r) ^(p) (z)--the pin planar radial peaking factor at node z.

F.sub.αn --the precalculated pin planar radial peaking factor for theCEA configuration represented by the subscript αn.

G_(i) --the position of group i.

F_(r) ^(CHAN) (z)--the channel planar radial peaking factor at node z.

P_(os) --out-of-sequence penalty factor.

P_(r+) --CEA deviation penalty factor for positive deviation.

P_(r-) --CEA deviation penalty factor for negative deviation.

P_(s+) --subgroup deviation penalty factor for positive deviation.

P_(s-) --subgroup deviation penalty factor for negative deviation.

S_(ij) --position of subgroup j, which belongs to group i.

T_(j) --position of the target CEA for group j.

Δ_(os) --limit on allowed group deviation for out-of-sequence condition.

Δ₄ --limit on allowed CEA deviation.

Δ_(s) --limit on allowed subgroup deviation.

Algorithm

Subgroup positions are found from

    S.sub.ij =T.sub.j for each subgroup j.

If the target CEA is the rod which deviates from the average subgroupposition, then for that j

    S.sub.ij =T.sub.j -D.sub.rj

The group position for group i is found from ##EQU3## The subgroupdeviation for group i is then ##EQU4## Having obtained the necessaryposition information, each axial node is evaluated to find: ##EQU5##Where: ##EQU6## and F.sub.αn is obtained from the precalculated table ofpin planar radial peaking factors for normal sequence groupconfigurations.

Detection and Calculation of Azimuthal Flux Tilt Magnitude

Indications of any azimuthal flux tilting are obtained by comparing thesignals from symmetrically located detectors. These signals are fittedto the functional form:

    φ(r,θ)=φ.sub.o (r,θ)[1+sg(r) cos (θ-θ.sub.o)]

where the fundamental flux pattern is designated as φ_(o), the amplitudeof the tilt by s, and the orientation of the tilt by φ_(o). Theseparable functional form in the second term of the equation has beensuggested by examination of tilted flux shapes from diffusion theoryrepresentations of mild xenon oscillations. The functional g(r), whichis given approximately by J₁ (α₁, r)/J_(o) (α_(o), r), can be used torelate the tilt signals from different sets of detectors if noasymmetrically placed rods are inserted. Where J₁ and J_(o) are Besselfunctions of the first kind of the zero and first orders.

Signals from symmetrically placed in core rhodium detector strings 18are analyzed to obtain s and θ_(o). One symmetrical set such as thisgives five values of s and θ_(o) since there are five axially locateddetectors in each string. Since there are five detectors per string,this gives 20 values of the pair (s, θ_(o)). The average value of s andθ_(o) are then found as well as the respective standard deviations. Astudy of the standard deviations gives some insight into whether or notthe average values of s and θ_(o) indicate a true flux tilt.

Core Average Power

The core average power is determined by two distinct methods. The firstmethod uses the response of the out-of-core detectors 16. The detectorsresponses are indicative of the neutron flux level in the core 12; whenthe ex-core detectors 16 are calibrated to the plant calorimetric, anychange in detector response is indicative of a change in neutron fluxlevel which in turn is indicative of a change in the power beingproduced in the fuel. The second method provides a measure of core powerby relating the temperature rise through the core 12 to the totalthermal power. The temperature rise through the core is obtained fromthe temperature detectors (RTD's) in the hot and cold leg coolantpiping.

In order to calculate the power level from the neutron flux levelsignals from the ex-core detectors, corrections for shape annealing, rodshadowing and inlet temperature are necessary. The shape annealing androd shadowing corrections have been discussed above. The correction forinlet temperature change is necessary because the detector responses aredependent upon the diffusion and absorption of nuetrons that occurbetween the core periphery and the detector locations.

Reactor coolant from the steam generators 26 passes between the core 12and detectors 16 before entering the core 12. As a result, the totalneutron leakage out of the reactor vessel and thus the ex-core detectorresponse is affected by the reactor coolant, which has temperaturedependent neutronic properties. This effect is defined as temperatureshadowing and has the characteristic of causing a decrease in detectorresponse for a decrease in inlet temperature. The temperature shadowingeffect is independent of the power distribution at the peripheral coreassemblies. The corrected detector responses for each detector segmentare summed to yield a quantity that is proportional to neutron powerlevel. A constant of proportionality is then applied to convert thedetector response to a calibrated thermal power level.

The ex-core detectors 16 respond very rapidly to changes in the neutronflux and, after the above corrections are made, provide a dynamicallyaccurate signal that can be used to sense core power changes. The corepower measurement obtained from the temperature rise across the core 12,on the other hand, is a statically accurate indicator of core power.This latter core power measurement, after calibration to the plantcalorimetric, provides a very accurate steady-state indication of corepower.

The thermal energy added to the coolant as it passes through the core 12serves as an indicator of core power. This relationship depends upon thefuel, cladding and coolant channel configuration, their heat transfercharacteristics and the primary coolant ΔT rise. The coolant hot leg 28temperature is measured by sensor 36 and the coolant cold leg 34temperature is measured by sensor 38. The difference between these twomeasurements is ΔT. The heat transfer properties of the fuel, clad andcoolant are dependent upon the core temperatures and volumetric flowrate of the coolant. Using standard thermodynamic models and methods thecore power can be determined by measuring the primary coolant hot 28 andcold 34 leg temperatures. These measurements are used in a mathematicalexpression which accurately models the core power by taking into accountthe variation of the heat transfer properties that are temperaturedependent. The core volumetric flow rate is obtained from the reactorcoolant pump 32 speed measurements.

The ΔT power measurement described above is also made more accurate forslow variations in core thermal energy by dynamically compensating thebasic steady-state expression with a measure of the rate of heataddition to the stored thermal energy in the primary coolant. This isaccomplished by differentiating the measured hot and cold legtemperatures, multiplying by constants and adding the products to thesteady-state expression.

Since the ΔT power measurement provides a very accurate steady-stateindication of core power, it is used as a calibration standard againstwhich the core power from the ex-core detectors is calibrated duringsteady-state operation. See U.S. Pat. No. 3,356,577 issued to YgalFishman on Dec. 5, 1967. The calibration technique provides an updatednuclear power signal proportional to the time averaged integral errorbetween the calculated nuclear power and ΔT power. The updating intervalis long compared to reactor dynamic characteristics to ensure that thedynamic accuracy of the ex-core detectors is maintained duringtransients.

In addition to providing a ΔT power calculation that is accurate forslow transients, the dynamic compensation described above will providean accurate ΔT power signal during incidents that involve rapid singleCEA deviations (especially a dropped CEA). In the event that a CEAdrops, the power distribution will be distorted. This distortion canhave the effect that the nuclear power signals in any one or more of thefour core protection calculator channels will not be indicative of thecore average power. The indicated nuclear power in any channel may behigher or lower than the core average power depending upon how thedropped CEA distorts the power distribution. The ΔT power, however, willnot be significantly affected. Therefore, the nuclear flux power will beused as the core average power indication unless a large CEA deviationis detected, at which time the CPCs will automatically use the ΔT poweras the core average power indication for the low DNBR and high localpower density trips.

Calculation of Corrected Neutron Flux Power

In order to calculate the power level as indicated by the neutron fluxlevel measured by the ex-core detectors, corrections for shape annealingand rod shadowing are necessary for each segment of each of the fourdetector channels. These corrected responses for each detector segmentare summed to yield a quantity proportional to the neutron flux powerlevel for each detector channel. A constant of proportionality is thenapplied to this quantity to convert the detector channel response to apreviously calibrated thermal power level.

The shape annealing correction factor is applied to the uncorrectedresponse of each segment of the four ex-core detector strings. Let D_(i)be the uncorrected response of segment i of a detector string. Let P_(i)be the detector response of segment i had the detector been placed atthe core periphery. In order to determine the external detector segmentresponse, the peripheral segment response must be corrected for theeffects of shape annealing. Let S_(ij) be the shape annealing correctionfactor which allows for contributions to an external detector segmentdue to the distribution of point sources along the core periphery. Thisrelationship can be conveniently expressed in matrix notation as

    D=S P

where

D is an n element column vector representing the external detectorsegment responses whose typical element is D_(i)

S is an n×n element matrix representing the shape annealing factorswhose typical element is S_(ij)

P is an n element column vector representing the peripheral detectorsegment responses whose typical element is P_(i).

In order to determine the peripheral detector response, the followingcalculation is required:

    P=S.sup.-1 D

Having determined the detector response had the detectors been at thecore periphery, it is now necessary to determine the detector responsein the absence of flux perturbations due to CEA insertion in the regionof the detector. Average CEA shadowing factors R are determined for eachdetector segment dependent on CEA insertion in the region of detectorsegment. This can mathematically be expressed as: ##EQU7## where R_(j)=Average CEA shadowing correction factor for detector segment j

X_(i) =Fraction of the overall segment length to which CEA shadowingfactor F_(i) applies

F_(i) =Planar CEA shadowing factor for a given CEA insertion

N=Number of different shadowing regions over a detector segment.

The X_(i) are determined by CEA position indications. The average CEAshadowing correction factor for each segment is applied to theperipheral detector response to yield a detector signal φ_(i) forsegment i proportional to nuclear power.

    φ=R.sup.-1 P

where

φ is an n element column vector representing a quantity proportional tonuclear power whose typical element is φ_(i)

R is an n×n diagonal matrix of average CEA shadowing factors whosetypical element is R_(ii)

P is an n element column vector representing the peripheral detectorresponse whose typical element is P_(i).

The individual segments i of each string are then summed. ##EQU8## whereφ=Total corrected detector channel response proportional to reactorpower

φ_(i) =Corrected response of segment i

The total summed response φ is corrected for temperature changes byapplying a factor that is proportional to the change in cold legtemperature. Let T_(f) be the temperature correction factor then

    φ.sub.N (t)=φ(t)·T.sub.f (t)

where

    T.sub.f (t)=1+C.sub.T (T.sub.co -T.sub.cmin (t))

T_(cmin) : is the minimum of the two cold leg temperature signals

C_(T) : is a proportionality constant relating the percent change inindicated neutron flux power for a one degree temperature change

T_(co) : is a base cold leg temperature which is set at the limit of theusable sensor range.

This number is proportional to the nuclear flux power as measured bythat detector channel. The constant of proportionality is determinedduring power range testing by calibrating the detector response to aknown steady state thermal power level. The final calculation requiredfor determining the calibrated neutron flux power is to correct thetotal average corrected detector response by the calibration factorK_(cal).

    φ.sub.cal =K.sub.cal φN

where:

φ_(cal) =Calibrated neutron flux power for the channel

K_(cal) =Calibration factor for detector response to power

φ_(N) =Total corrected detector channel response for the channel.

The calibration factor is obtained on-line by making use of thecalculated ΔT power. The algorithms employed to perform this calibrationare described infra.

Calculation of Core Thermal Power (ΔT Power)

The calculated core thermal power is obtained using a correlation basedon measured coolant conditions. The information available as input tothis calculation consists of hot and cold leg temperature signals, thereactor coolant system mass flow rate and an indication of the number ofreactor coolant pumps running.

The ΔT power is calculated in two portions, a static calculation and adynamic calculation.

Static Calculation:

The two hot and cold leg temperature inputs are averaged and used in thefollowing equation: ##EQU9## where ##EQU10## T_(h) : hot leg temperatureT_(c) : cold leg temperature

f_(i) (m): are fitted coefficients that are a function of coolant massflow rate and are of the general form: f_(i) (m)=a_(i) m+b_(i) m² +c_(i)with a_(i), b_(i), c_(i) being constants.

The static ΔT power equation conservatively calculated the variationin-core power with temperature changes, mass flow rate and coolantspecific heat (which is temperature dependent).

Dynamic Calculation

The hot and cold leg temperature signals used in the static calculationare obtained from Resistance Temperature Detectors (RTDs) in the primarycoolant piping. As a result of their location the hot leg temperaturesignal will "lag" the core outlet temperature due to the transport timeinvolved through the coolant piping; similarly the cold leg temperaturesignal will "lead" the core inlet temperature. Dynamic compensation isprovided to accommodate this effect as follows: ##EQU11## where T_(x) :is a weighted average of the hot and cold leg temperature signals,defined as

    T.sub.x =W.sub.1 T.sub.h +W.sub.2 T.sub.c

with W₁ and W₂ being weighting coefficients.

f₄ (m): is a flow dependent coefficient as described above. ##EQU12##where τ_(l) is an equivalent coolant transport lag time constant and

τ is a derivative gain which accounts for coolant transport delays andsensor time constants.

Dynamic Compensation assures that the ΔT power agrees with the heat fluxtransmitted out of the fuel pin. The dynamic portion of the ΔT power isimplemented using a Z transform of the above equation as ##EQU13##where: ΔS: is the time between updates of B.sub.ΔT^(dyn)

The total ΔT power is then ##EQU14## The calculated ΔT power is used tocalibrate the nuclear flux power, as described hereinafter.

Calculations for Calibration of Neutron Flux Power to ΔT Power

The calculated ΔT Power, described supra, is used to calibrate thecorrected neutron flux power. The calibration algorithm is specified toprovide an accurate calibration during steady-state operation but retainthe rapid neutron flux power response during anticipated operationaloccurrences. The flux power calibration is achieved by means of aproportionality constant multiplier (K_(cal)) on the corrected neutronflux power. The calibrated neutron flux is defined by

    φ.sub.cal =K.sub.cal ×φ.sub.N

where

φ_(cal) : calibrated neutron flux power

K_(cal) : calibration factor

φ_(N) : total corrected detector response

The calibration factor is defined by the following equation: ##EQU15##where: K_(cal) (t-ΔS): is the calibration factor that was calculated atthe previous sampling time

ΔS: is the time internal between K_(cal) updates

τ_(k) : is an error weighting factor which is less than unity

B: ΔT power

The error weighting factor is chosen to result in an effective neutronflux power calibration time constant of approximately 4 minutes. Themeans that if there were a step change in ΔT power is would take about16 minutes for the difference between neutron flux power and ΔT power tobe reduced to 2 percent of its initial value.

The above technique is used for calibration during conditions when thereis no excessive CEA deviation. In the event that excessive CEA deviationoccurs the neutron flux power indication can rapidly decalibrate. Theflux power calibration algorithm consists of logic which will change themode operation of calibrated neutron flux power as the power input tothe DNBR and local power density set point calculation. This mode willoccur for those CEA configurations which are not accommodated by the CEAshadowing correction. In this mode, the ΔT power is the primary powerinput. The ΔT power conservatively predicts the core average power forthese conditions.

Method Used to Determine Reactor Coolant System Mass Flow Rate

The primary coolant mass flow rate is used in the low DNBR trip. Themass flow rate is obtained using the pump speed inputs from the reactorcoolant pumps 32, the primary coolant pressure, and the core inlettemperature. The volumetric flow rate through each reactor coolant pumpis dependent upon the rotational speed of the pump and the pump head.This relationship is typically shown in pump characteristic curves. Flowchanges resulting from changes in the loop flow resistances occur slowly(i.e., core crud buildup, increase in steam generator resistance, etc.).Calibration of the pump speed signal, relating pump rotational speed tovolumetric flow, will be performed periodically using pump ΔPinstrumentation which is not part of this invention.

Flow reductions associated with pump speed reductions are more rapidthan those produced from loop flow resistance changes. The pumprotational speed signal is converted to a pump volumetric flow usingmathematical relationships based on pump characteristics and periodicloop flow calibrations. The algorithm used is conservative relative tothe actual pump performance.

The volumetric flow rates calculated for each pump 32 are summed to givea vessel flow. The vessel flow is corrected for core bypass and densityand the result is the core mass flow rate.

Calculation of Reactor Coolant System Mass Flow Rate

The reactor coolant system mass flow rate is obtained from therotational speed of each reactor coolant pump 32. This is done by makinguse of the pump characteristic curves, summing the four pump volumetricflow rates, correcting for internal and external vessel flow leakage andcorrecting for density variations.

Proximity probes are used to measure the shaft rotational speed. Thevolumetric flow rate for each pump is defined by the generalrelationship shown below:

    V.sub.i =F.sub.i 8RPM, ΔP(RPM,N), N)

where:

V_(i) =volumetric flow rate of pump i

RPM=pump shaft rotational speed

ΔP=pump head (obtained for periodic calibration)

N=number of coolant pumps running

The total vessel volumetric flow rate is the sum of the pump flows. Thesummed flows are adjusted for core bypass as follows: ##EQU16## where:V_(core) : volumetric flow rate through the core

K_(bypass) : flow bypass correction factor

The core volumetric flow rate is corrected for density to obtain themass flow rate as follows:

    M=V.sub.core 8C.sub.0 +C.sub.1 (T.sub.c -T.sub.co)+C.sub.2 (P-P.sub.o))

where:

m: is the mass flow rate

C₀ : is the density correction at base inlet temperature (T_(co)) andpressure (P_(o))

C₁ and C₂ : are coefficients that reflect the density change from thebase conditions

T_(c) : is the maximum of the two cold leg temperature inputs

P: is the measured pressurizer pressure

Method Used to Determine Local Power Density Trip Set Point

The local power density distribution in the fuel is dependent upon thecore power distribution. The objective of establishing a trip on highlocal power density is to prevent the centerline fuel temperature in the"hottest" fuel pellet in the core from exceeding the melting point. Thecenterline fuel temperature is dependent upon the pellet geometry,pellet composition, the amount of energy deposited in the fuel, thelocal power density, the gap and cladding configuration and their heattransfer characteristics.

The core power distribution can be related to the local power densitydeposited in the fuel by a proportionality constant. The powerdistribution in the "hot" pin can be obtained by the methods describedsupra.

In the steady-state, the deposited local power density can be related tothe centerline fuel temperature by a proportionality constant when thetemperature profile across the fuel diameter is known. Therefore, thecenterline fuel temperature can be directly related to the powerdistribution in the "hot" fuel pin.

During transient conditions, the deposited local power density can berelated to the centerline fuel temperature through standard heatconduction models which predict the spatial variation in the fueltemperature profile as a function of the heat transfer time constant ofthe fuel. Therefore, changes in centerline fuel temperature can bedirectly related to changes in the power distribution in the "hot" pin.

The local power density trip set point is defined as that value of coreaverage power which corresponds to a power density in a fuel pelletwhich would result in raising the steady-state centerline fueltemperature to the melting point for a given three-dimensional peakingfactor. The three-dimensional peaking factor is defined as the maximumproduct of the normalized core average axial power distribution andaxially varying planar radial peaking factor adjusted for allowedazimuthal tilt magnitude. This definition of the set point assures thatthe local power density in the "hottest" fuel pellet is accommodated andthat the dynamics of the fuel temperature variation are correctlydefined.

The basic operation of the high local power density trip is as follows:

a. a power trip set point is calculated as described above;

b. the indicated core average power is compared to the set point;

c. a trip will occur if the core average power remains equal to the setpoint for a fixed time interval.

If the core average power becomes greater than the set point a trip willoccur in a time interval that is a function of the amount by which thecore average power exceeds the set point and the transientcharacteristics of the set point. The time interval that occurs before atrip signal is generated is obtained by delaying the setpoint transientresponse to account for the fuel temperature time constant andaccelerating the set point transient response to account for protectivesystem time delays, CEDM de-energization time and the time required toeffectively terminate the occurrence.

Calculation of Local Power Density Set Point

The local power density set point is that value of the core power whichcould correspond to the limiting local power density for a giventhree-dimensional peaking factor and azimuthal tilt magnitude.

The information available for calculating the set point consists of theplanar radial peaking factors, (F_(r) ^(p) (z)), the normalized coreaverage axial power shape, (F_(z) (z)), and the azimuthal tilt magnitude(T_(r)).

The maximum value of the product F_(z) (z)F_(r) ^(p) (z) is the 3-Dpeaking factor, which is defined as the ratio of the peak local powerdensity to the core average power density. Thus, if C_(S) represents thelimiting local power density divided by the full power average localpower density, the ratio of C_(s) to F_(z) (z)F_(r) ^(p) expressed as apercentage gives the core power at which this limit will be reached.Reducing this by the amount of azimuthal tilt results in the staticlocal power density set point, B_(sp) ^(st), which is the value of coreaverage power that would result in centerline fuel melt in steady-state.This set point is passed through the digital equivalent of a lead-lagfilter of the form: ##EQU17## The output of the filtered set point isthe local power density trip set point, B_(sp). The algorithm issummarized below.

Algorithms for Local Power Density Set Point Calculation

Definitions

B_(sp) ^(st) --local power density static set point

B_(sp) --local power density trip set point

C_(s) --a constant based on the allowed limiting value of the localpower density

F_(r) ^(p) (z)--the pin planar radial peaking factor at node z

F_(z) (z)--the normalized core average axial power distribution,expressed as the ratio of the power at axial node z to the average power

T_(r) --the azimuthal tilt magnitude

ΔS--time between static set point samples

τ₁ --protective system equivalent delay time

τ₂ --fuel, gap and clad effective time constant

Algorithm

The local power density static set point is found from: ##EQU18## wheremax F_(z) (z)F_(r) ^(p) (z) is the maximum value of the productevaluated at each node z.

The trip set point is found using a z-transform of the lead-lag filteras follows: ##EQU19##

High Local Power Density Trip Signal Generation

The local power density trip set point that is calculated as describedabove is compared to the measured core average power. The core averagepower measurement is either the corrected neutron flux power or thecalculated ΔT power depending upon the conditions discussed above. Basedupon this comparison the following actions are initiated:

a. if: M₂ <B_(sp) -φ_(cal) ≦M1

a contact opening output is sent to the Reactor Protective System 2/4CEA withdrawal prohibit logic.

b. if: 0.0<B_(sp) -φ_(cal) ≦M2

a contact opening output provides a channel pre-trip annunciation and acontact closure output provides a signal to the 2/4 Power ReductionControl Signal logic.

c. if: B_(sp) -φ_(cal) ≦0.0

a contact opening output provides a channel trip signal to the 2/4 RPStrip logic.

The values of M1 and M2 are margins to trip expressed in terms ofpercent of core power, with M1>M2.

Method Used to Determine DNBR

The Core Protection Calculators require a correlation for calculation ofon-line minimum DNBR. Input to the calculation will include the instantreactor conditions of mass flow, integrated nuclear planar radialpeaking factor, the ratio of maximum average fuel assembly power to coreaverage assembly power, coolant inlet temperature, a measure of theaxial power distribution, and reactor coolant system pressure. Asimplified closed channel hydraulic model is used as the algorithm forthe on-line computation of DNBR. This on-line computation may mosteasily be done in a special purpose digital computer. Since the closedhot channel calculation does not take into consideration turbulentinterchange of coolant between the hot channel and the neighboringchannels, an adjustment to the algorithm's input is required. Thisadjustment is made to the mass velocity in the channel such that whenall other conditions are the same, the closed channel minimum DNBRequals the minimum DNBR obtained by considering the interchange ofcoolant between channels. The adjusted mass velocity is found byevaluating an analytically derived Equivalent Mass Velocity Correlation.

The Equivalent Mass Velocity Correlation is an expression of the form:##EQU20## where Ge=algorithm required mass velocity;

Go=channel mass velocity at nominal reactor condition;

A_(i), B_(i) =analytically determined form coefficients for ithparameter;

ΔΨ_(i) =change of ith parameter from its nominal value.

The coefficients of the polynominal fit are analytically determined bythe following scheme.

a. Input parameters are varied individually in many calculationsperformed off-line with detailed thermal hydraulic design codes.

b. The same input is used in the on-line version of the model with theexception that mass velocity is iterated upon such that the DNBRobtained from the off-line codes is matched.

c. Knowing the input variations from one case to the next and therequired mass velocity for prediction of the minimum DNBR, thecoefficients of the mass velocity correlation can be determined viamultiple regression calculations. However, the minimum DNBRs producedhere must equal or exceed those which result from the on-linecalculations.

The Equivalent Mass Velocity Correlation is dependent upon all the inputparameters mentioned above. The integrated planar radial peaking factoris defined as the integrated value of the product of the axial dependentplanar radial peaking factors and the normalized core average axialpower distribution. The ratio of the maximum assembly power to the coreaverage assembly power is related to the integrated planar radialpeaking factor by a proportionality constant.

The DNB trip is basically composed of two distinct levels ofcalculation. The first level can be termed as the periodic static orsnapshot calculation and the second level as the update calculation. Inthe periodic calculation, the most recent values of the monitoredvariables or calculated parameters that affect the DNBR are used todetermine the DNBR. This calculation employs the Equivalent MassVelocity Correlation discussed above and a simplified version of the W-3correlation. The update calculation will be used to update the DNBRbetween periodic calculations. The relationships involved consist ofpolynominal functions that have been obtained from extensive analysisusing a standard DNBR analysis method.

Calculations for Minimum DNBR

The minimum DNBR in the "hot" channel is calculated using the followingcalculated parameters and monitored NSSS variables:

a. calculated normalized core average axial power distribution,

b. calculated axially dependent one-pin and coolant channel planarradial peaking factors,

c. calculated reactor coolant mass flow rate,

d. calibrated neutron flux power,

e. maximum of the two input cold leg temperatures, and

f. the monitored reactor coolant system pressure.

Periodic DNBR Calculation

The periodic calculation uses the inputs listed above, in the EquivalentMass Velocity Correlation and simplified version of the W-3 correlation.

The equivalent mass velocity is defined by ##EQU21## where: g*: is thechannel mass velocity at a datum (for instance nominal reactorconditions)

m: is the calculated coolant mass flow rate in percent of 4 pump designflow ##EQU22## F_(r) ^(int) : is the integrated planar radial peakingfactor defined by ##EQU23## F_(z) (z): is the normalized core averageaxial power distribution F_(r) ^(p) (z): is the axially dependent planarradial peaking factor

P_(pri) : is the pressurizer pressure

φ_(cal) : is the calibrated neutron flux power

T_(cmax) : is the maximum of the two cold leg temperature inputs

C_(i) 's and α₁ : are constants

Knowing the equivalent mass velocity and the axial distribution at 25axial nodes, the coolant enthalpy rise can be calculated up the channelfrom ##EQU24## where: H_(i) : average coolant enthalpy at node i

H.sub.|z=0 : coolant enthalpy at core inlet

ΔH_(i) : coolant enthalpy rise at node i

F_(r).sbsb.i^(chan) : channel planar radial peaking factor at node i,defined by

    F.sub.r.sbsb.i.sup.chan =constant x F.sub.r.sbsb.i.sup.p

T_(r) : azimuthal tilt magnitude

With the coolant enthalpy known at each node, the critical heat flux iscalculated

    Qcrit.sub.i =f.sub.1 (φ.sub.cal, Ge, H.sub.i, T.sub.cmax, P.sub.pri, F.sub.r.sbsb.i chan, F.sub.z.sbsb.i)

The complicated expressions for Qcrit_(i) involving several empiricallyderived constants utilizes the standard W-3 correlation developed byTong and may be found in: L. S. Tong, "Prediction of Departure fromNucleate Boiling for an Axially Non-uniform Heat Flux Distribution,"Journal of Nuclear Energy, 21:241-248, 1967.

The local heat flux at each node defined by

    Qlocal.sub.i =f.sub.2 (φ.sub.cal, T.sub.r, F.sub.r.sbsb.i.sup.p, F.sub.z.sbsb.i)

is divided into the critical heat flux to give the DNBR at each node,

    DNBR.sub.i.sup.periodic =Qcrit.sub.i /Qlocal.sub.i

The minimum DNBR resulting from the periodic portion of the calculationis then

    DNBR.sup.periodic =min[DNBR.sub.i.sup.periodic ]

DNBR Update Calculation

The periodic calculation described above will be performed approximatelyevery 2 seconds. In this time interval the update calculation is used toupdate the statically calculated DNBR. In this context, when"continuously" is used in the description and in the claims it should betaken to mean: "of a substantially higher periodicity than the frequencyof the periodic calculation."

The local heat flux defined as

    Qlocal.sub.i =constant·φcal·F.sub.z.sbsb.i ·F.sub.r.sbsb.i.sup.p ·(1+T.sub.r)

is calculated on a nodal basis. The update calculation is performedapproximately every 20 millisec. Therefore, the periodic calculationwill never have an input that is more than 20 millisec delayed.

The periodic DNBR is updated within the interval between periodiccalculations by comparing the inputs to the values of the inputs used inthe most recently completed periodic calculation. The differences in theinput values are used to calculate the change in the periodic DNBR ateach node by a partial derivative approached as shown below ##EQU25##where: ΔDNBR_(i) (t): is the change in DNBR at node i ##EQU26## etc.:are functions that relate a change in a particular parameter to anequivalent change in DNBR. These functions will be conservatively chosenconstants or polynomial expressions that depend upon the measured valuesof other pertinent parameters.

Qlocal_(i) (t): is the heat flux at node i

T_(cmax) (t): is the inlet temperature ##EQU27## : is the value of theheat flux at node i used in the periodic DNBR calculation ##EQU28## : isthe value of the inlet temperature used in the periodic DNBR calculation

m(t): is the current calculated value of the reactor coolant mass flowrate

m^(periodic) : is the mass flow rate used in the periodic DNBRcalculation

P_(pri) (t): is the current sampled value of the primary coolantpressure ##EQU29## : is the value of the primary pressure used in theperiodic DNBR calculation

The updated DNBR at each node is then

    DNBR.sub.i (t)=DNBR.sub.i.sup.periodic +ΔDNBR.sub.i (t)

The minimum DNBR is then

    DNBR(t)=min[DNBR.sub.i (t)]

It will be understood that the embodiment shown and described herein ismerely illustrative and that changes may be made without departing fromthe scope of the invention as claimed.

What is claimed is:
 1. An improved Nuclear Power System fuel damageprotection apparatus for the prevention of the violation of a fueldesign limit, said apparatus being of the type which utilizes an indexwhich is representative of the proximity of the violation of said designlimit, said index being mathematically represented by an equation whichdefines the functional relationship between said index and amultiplicity of system parameters, said apparatus including means forcontinuously generating a multiplicity of electrical signals which eachvary as a function of one of said multiplicity of system parameters andmeans responsive to said multiplicity of electrical signals forperiodically sampling said signals and for periodically generating anelectrical signal commensurate with said index of said system at thetime of said sampling, the improvement comprising:a. means responsive tosaid sampled parametric signals and to said continuously generatedparametric signals for continuously generating an index updateelectrical signal commensurate with the change of index which occursafter said sampling; b. means responsive to said signal commensuratewith the index of said system at the time of said sampling and to saidindex update signal for summing said signal to continuously generate anelectrical signal commensurate with an up-to-date value of the index ofsaid systems; and c. means responsive to the signal commensurate withthe up-to-date value of the index for correctively regulating saidNuclear Power System when the value of the index indicates a designlimit violation.
 2. The apparatus of claim 1 wherein said meansresponsive to said sampled parametric signals and to said continuouslygenerated parametric signals for continuously generating an index updatesignal, includes:(1) comparison means responsive to said sampledparametric signals and to said continuously generated parametric signalsfor continuously generating signals commensurate with the change betweensaid sampled parametric signals and said continuously generatedparametric signals of the same parameter; and (2) means responsive tosaid signals commensurate with said change between said sampledparametric signals and said continuously generated parametric signals ofelement (1) for generating an electrical signal commensurate with thesum of changes in said index due to changes in said continuouslygenerated parametric signals.
 3. The apparatus of claim 1 furthercomprising:f. means responsive to one of said continuously generatedelectrical parametric signals for generating an electrical signalcommensurate with a projection of said index due to the projected changeof said one parametric signal over a projected time period (T).
 4. Theapparatus of claim 3 wherein said index is a departure from nucleateboiling ratio (DNBR) and said apparatus further comprising:g. means forselecting the smaller of said signal commensurate with the up-to-dateDNBR of said system and said signal commensurate with said projection ofDNBR; h. means for generating a trip set point electrical signalcommensurate with the minimum allowable value of DNBR; and i. meansresponsive to said smaller DNBR signal of element (g) and said DNBR setpoint for comparing said smaller DNBR signal and said DNBR set pointsignal.
 5. The apparatus of claim 3 wherein said means for generating anelectrical signal commensurate with a projection of index comprises:(1)means responsive to said one parametric signal for generating a signalcommensurate with a projected change of index due to the projectedchange of said one parametric signal over a projected time period (T);and (2) means for summing said signal commensurate with a projectedchange of index and said continuously generated index signalcommensurate with said up-to-date index of said system for generating anelectrical signal commensurate with a projected index due to the changeof said one parametric signal over a projected time period (T).
 6. Theapparatus of claim 5 wherein said means for generating an electricalsignal commensurate with a projected change of index due to theprojected change of said one parametric signal over a projected timeperiod (T) comprises:a. means responsive to said one parametric signalfor continuously generating an electrical signal commensurate with thederivative of said one parametric signal with respect to time; b. meansresponsive to said signal commensurate with the derivative of said oneparametric signal with respect to time for generating an electricalsignal commensurate with the product of said derivative signal and avalue commensurate with the partial derivative of said index withrespect to said reactor parameter represented by said one parametricsignal, said generated signal is a signal commensurate with thederivative of said index with respect to time; c. means responsive tosaid signal of element (b) (the derivative of index with respect totime) for generating an electrical signal commensurate with the productof said signal of element (b) and a value commensurate with a timeperiod (T), said product signal is a signal commensurate with aprojected change of index over a projected time period (T) due to aprojected change in said one parametric signal.
 7. The apparatus ofclaim 6 wherein said system includes a nuclear reactor with a core whichis cooled by a coolant circulating there through and which is controlledby the insertion of control rods, and said one parametric signal is asignal commensurate with said reactor's parameter of coolant system flowrate, and wherein said time period (T) is a function of said reactor'sparameter of axial power distribution, said apparatus furthercomprising:d. means responsive to said parametric signal commensuratewith axial power distribution for generating an electrical signalcommensurate with a time period (T) as a function of axial powerdistribution.
 8. The apparatus as recited in claim 1 wherein said indexis departure from nucleate boiling ratio (DNBR) and said apparatusfurther includes:f. means responsive to one of said parametric signalscommensurate with a Nuclear Power System parameter for generating anelectrical signal commensurate with a change in DNBR due to the changeof said one parameter with respect to the long term average value ofsaid parameter, said average value constrained to be equal to or lesslimiting on DNBR than the continuously generated value of saidparameter; g. means for generating an electrical signal commensuratewith a preselected value of DNBR which is higher by a predeterminedmargin than the minimum allowable value of DNBR for which a criticalheat flux is exceeded; h. means responsive to said signals of elements(f) and (g) for summing said signals to generate a signal commensuratewith an updated DNBR margin; i. means responsive to said updated DNBRmargin signal of element (h) and to said signal commensurate with anup-to-date value of DNBR of said system of element (e) for selecting thelarger of the two signals of elements (h) and (e); j. means responsiveto said one parametric signal for generating an electrical signalcommensurate with a projected change of DNBR due to the projected changeof said parametric signal over a projected time period (T), saidprojected change being limited to negative values; and k. meansresponsive to said larger signal of element (i) and to said signalcommensurate with a projected change of DNBR due to the projected changeof said parametric signal over a projected time period (T) of element(j) for summing said signals of elements (j) and (i).
 9. The apparatusrecited in claim 8 further comprising:(1) means for generating a tripsetpoint electrical signal commensurate with the minimum allowable DNBRvalue; and m. means responsive to said summed signal of element (k) andto said trip setpoint signal of element (1) for comparing said signals.10. The apparatus as recited in claim 8 wherein said means forgenerating an electrical signal commensurate with a change in DNBR dueto the change of said parameter with respect to the long term averagevalue of said parameter includes;(1) means responsive to said oneparametric signal for continuously generating an electrical signalcommensurate with the average value of said one parametric signal over apreselected finite period of time, said average value constrained to beequal to or less limiting on DNBR than the continuously generated valueof said parameter; (2) means for continuously subtracting said signalcommensurate with the average value of said one parametric signal ofelement (1) from the continuously generated value of said one parametricsignal to generate an electrical signal commensurate with the mostrecent deviation of said parameter from its average value taken over afinite period of time; (3) means for multiplying said signalcommensurate with the most recent deviation of said one parameter fromits average value of element (2) by a signal commensurate with thepartial derivative of DNBR with respect to the parameter of said oneparametric signal to generate a signal commensurate with the change inDNBR due to the change of said one parameter.
 11. A method forpreventing the violation of a Nuclear Steam Supply System design limitsaid system having a nuclear reactor with a core and having fuel pinsand channels therein through which a coolant is circulated, said methodcomprising the steps of;a. continuously generating a multiplicity ofelectrical parametric signals which are commensurate with a multiplicityof Nuclear Steam Supply System parameters, said parameters including theparameters used in calculating the DNBR of said reactor core; b.periodically sampling said parametric signals; c. generating from saidperiodic samples of said parametric signals a periodic DNBR electricalsignal commensurate with the DNBR of said reactor core at the time ofsaid sampling; d. continuously comparing one of said continuouslygenerated parametric signals to the periodically sampled signal of thesame parameter used to generate the next previous periodic DNBR signal;e. generating an electrical signal commensurate with the change in DNBRdue to the change in said parameter; f. continuously generating anupdated DNBR signal responsive to the electrical signal commensuratewith the periodic DNBR of said reactor core at the time of said samplingand said electrical signal commensurate with the net change in DNBR dueto the change in said parameter to continuously generate an electricalsignal commensurate with the actual DNBR of said reactor core; and g.correctively regulating said Nuclear System when the continuouslygenerated DNBR signal indicates a design limit violation.
 12. The methodof claim 11 further including the steps of:g. generating an electricalsignal commensurate with a projection of DNBR due to a projection of oneof said continuously generated electrical parametric signals over aprojected time period (T); h. generating a DNBR trip set pointelectrical signal commensurate with the minimum allowable DNBR value; i.comparing said signal commensurate with the projected DNBR of saidreactor core and said signal commensurate with the minimum allowableDNBR value; and j. correctively regulating said reactor when said signalcommensurate with said projected DNBR equals or falls below said signalcommensurate with the minimum allowable DNBR value.
 13. An improvedNuclear Power System Protection Apparatus for the prevention of theviolation of a nuclear power system design limit the proximity to whichis indicated by an index, the improvement comprising:a. means fordetermining a time derivative of said index or a component part thereof;b. means responsive to said time derivative for multiplying said timederivative by a positive time period (T) to generate an electricalsignal commensurate with a projection of said index into the future oversaid time period (T); and c. means responsive to said electrical signalcommensurate with a projection of said index for correctively regulatingsaid nuclear power system.
 14. An improved Nuclear Power System fueldamage protection apparatus as recited in claim 13 for the prevention ofthe violation of a fuel design limit, said apparatus being of the typewhich utilizes an index which is representative of the proximity of theviolation of said design limit, said index being mathematicallyrepresented by an equation which defines the functional relationshipbetween said index and a multiplicity of system parameters, saidapparatus including means for continuously generating a multiplicity ofelectrical signals which each vary as a function of one of saidmultiplicity of system parameters and means responsive to saidmultiplicity of electrical signals for generating an electrical signalcommensurate with said index, the improvement comprising:a. meansresponsive to one of said continuously generated electrical parametricsignals for generating an electrical signal commensurate with aprojection of said index due to the projected change of said oneelectrical parametric signal over a projected time period (T).
 15. Theimproved fuel damage protection apparatus as recited in claim 14 whereinsaid means for correctively regulating said Nuclear Power Systemincludes:a. means for generating a trip setpoint electrical signalcommensurate with a limiting value of said index; and b. meansresponsive to said electrical signal commensurate with a projection ofsaid index due to the projected change of said one parametric signalover the projected time period (T) and responsive to said trip setpointelectrical signal for tripping said Nuclear Power System when saidprojection of said index reaches said trip setpoint.
 16. Said improvedfuel damage protection apparatus as recited in claim 14 wherein saidindex is the Departure From Nucleate Boiling Ratio.
 17. Said improvedfuel damage protection apparatus as recited in claim 14 wherein saidindex is the Departure From Nucleate Boiling Ratio (DNBR).
 18. Theimproved fuel damage protection apparatus as recited in claim 17 whereinsaid time period (T) includes the reaction time of said fuel damageprotection apparatus.
 19. The improved fuel damage protection apparatusas recited in claim 14 wherein said time period (T) includes thereaction time of said fuel damage protection apparatus.
 20. An improvedmethod for the protection against violation of a nuclear power systemdesign limit the proximity to which is indicated by an index, theimprovement comprising:a. determining a time derivative of said index ora component part thereof; b. multiplying said time derivative by apositive time period (T) to generate an electrical signal commensuratewith a projection of said index into the future over said time period(T); and c. correctively regulating said nuclear power system inresponse to said electrical signal commensurate with a projection ofsaid index.
 21. An improved method as recited in claim 20 for theprotection against the violation of a Nuclear Power System design limitthe proximity to which is indicated by an index, said index beingcalculated from a multiplicity of system parameters by a mathematicalequation which defines the functional relationship between said indexand said multiplicity of system parameters the improvement comprisingthe steps of:a. generating an electrical signal commensurate with aprojection of said index due to the projected change of one of saidparametric signals over a projected time period (T).
 22. The improvedmethod of claim 21 wherein said Nuclear Power System has a nuclearreactor with a reactor core with a coolant circulated there through andwherein said index is Departure From Nucleate Boiling Ratio and whereinsaid system parameters include reactor core power, reactor core powerdistribution, reactor coolant temperature, reactor coolant pressure andreactor coolant flow rate.
 23. The improved method of claim 22 whereinsaid time period (T) depends on one of system reaction time and corepower distribution.
 24. The improved method of claim 21 wherein saidstep of correctively regulating said Nuclear Power System includes thesteps of:1. generating an index trip set point electrical signalcommensurate with a limiting value of said index;
 2. comparing saidsignal commensurate with the projected value of said index and saidsignal commensurate with said limiting value of said index; and 3.correctively regulating said Nuclear Power System when said signalcommensurate with said projected value of said index reaches said signalcommensurate with said limiting value of said index.
 25. The improvedmethod of claim 24 wherein said Nuclear Power System has a nuclearreactor with a reactor core with a coolant circulated there through andwherein said index is Departure From Nucleate Boiling Ratio and whereinsaid system parameters include reactor core power, reactor core powerdistribution, reactor coolant temperature, reactor coolant pressure andreactor coolant flow rate.
 26. The improved method of claim 25 whereinsaid time period (T) depends on one of system reaction time and corepower distribution.
 27. The improved method of claim 21 wherein saidtime period (T) includes system reaction time.
 28. The improved methodof claim 21 wherein said Nuclear Power System includes a nuclear reactorwith a core and said time period (T) depends upon one of system reactiontime and core power distribution.
 29. A method for preventing theviolation of a nuclear steam supply system design limit said systemhaving a nuclear reactor with a core and having fuel pins and channelstherein through which a coolant is circulated, said method comprisingthe steps of:a. generating a multiplicity of electrical parametricsignals which are commensurate with a multiplicity of nuclear steamsupply system parameters, said parameters including the parameters usedin calculating the DNBR of said reactor core; b. generating from saidparametric signals of step (a) an electrical signal commensurate with aprojection of DNBR over a predetermined time period (T), said projectiongenerating step including the steps of determining from said parametricsignals a time derivative and multiplying said time derivative by apositive value of said time period (T); c. generating an electrical setpoint signal commensurate with the minimum allowable DNBR value; d.comparing said signal commensurate with said projection of DNBR and saidsignal commensurate with the minimum allowable DNBR value; and e.correctively regulating said reactor when said signal commensurate withsaid projected DNBR equals or falls below said signal commensurate withthe minimum allowable DNBR value.
 30. An improved Nuclear Power Systemfuel damage projection apparatus for the prevention of the violation ofa fuel design limit, said apparatus being of the type which utilizes anindex which is representative of the proximity of the violation of saiddesign limit, said index being mathematically represented by an equationwhich defines the functional relationship between said index and amultiplicity of system parameters, said apparatus including means forcontinuously generating a multiplicity of electrical signals which eachvary as a function of one of said multiplicity of system parameters andmeans responsive to said multiplicity of said electrical signals forgenerating an electrical signal commensurate with said index, theimprovement comprising:a. means responsive to one of said continuouslygenerated electrical parametric signals for generating an electricalsignal commensurate with a projection of said index due to the projectedchange of said one electrical parametric signal over a projected timeperiod (T), said means for generating an electrical signal commensuratewith a projection of said index including means responsive to the rateof change of said one parametric signal for generating a signalcommensurate with a projected change of index due to the projectedchange of said one parametric signal over a projected time period (T);and b. means for summing said signal commensurate with a projectedchange of index and said electrical signal commensurate with said indexfor generating an electrical signal commensurate with a projected indexdue to the change of said one parametric signal over a projected timerperiod (T). c. means responsive to said electrical signal commensuratewith a projection of said index for correctively regulating said NuclearPower System.
 31. The improved fuel damage protection apparatus asrecited in claim 30 wherein said means for generating an electricalsignal commensurate with a projected change of index due to theprojected change of said one parametric signal over a projected timeperiod (T) comprises:a. means responsive to said one parametric signalfor continuously generating an electrical signal commensurate with thederivative of said one parametric signal with respect to time; b. meansresponsive to said signal commensurate with the derivative of said oneparametric signal with respect to time for generating an electricalsignal commensurate with the product of said derivative signal and avalue commensurate with the partial derivative of said index withrespect to said reactor parameter represented by said one parametricsignal, said generated signal is a signal commensurate with thederivative of said index with respect to time; c. means responsive tosaid signal of element (b) (the derivative of index with respect totime) for generating an electrical signal commensurate with the productof said signal of element (b) and a value commensurate with a timeperiod (T), said product signal is a signal commensurate with aprojected change of index over a projected time period (T) due to aprojected change in said one parametric signal.
 32. The improved fueldamage protection apparatus as recited in claim 31 wherein said systemincludes a nuclear reactor with a core which is cooled by a coolantcirculating there through and which is controlled by the insertion ofcontrol rods, and said one parametric signal is a signal commensuratewith said reactor's parameter of coolant system flow rate, and saidapparatus further comprising means responsive to said reactor's axialpower distribution for generating an electrical signal commensurate witha time period (T) as a function of axial power distribution.
 33. Theimproved fuel damage protection apparatus as recited in claim 32 whereinsaid time period (T) further includes a portion equivalent to thereaction time of said fuel damage protection apparatus.
 34. The improvedfuel damage protection apparatus as recited in claim 31 wherein saidtime period (T) includes at least a portion determined by the reactiontime of said fuel damage protection apparatus.
 35. The improved fueldamage protection apparatus as recited in claim 30 wherein said timeperiod (T) includes the reaction time of said fuel protection apparatus.36. An improved Nuclear Power System fuel damage protection apparatusfor the prevention of the violation of a fuel design limit, saidapparatus being of the type which utilizes an index which isrepresentative of the proximity of the violation of said design limit,said index being mathematically represented by an equation which definesthe functional relationship between said index and a multiplicity ofsystem parameters, said apparatus including means for continuouslygenerating a multiplicity of electrical signals which each vary as thefunction of one of said multiplicity of system parameters and meansresponsive to said multiplicity of electrical signals for generating anelectrical signal commensurate with said index, wherein said index isDeparture From Nucleate Boiling Ratio (DNBR) and wherein said apparatusincludes means responsive to one of said continuously generatedelectrical parametric signals for generating an electrical signalcommensurate with a projection of said index due to the project changeof said one electrical parametric signal over a projected time period(T), and wherein the improvement comprises:1. means responsive to one ofsaid parametric signals commensurate with a Nuclear Power Systemparameter for generating an electrical signal commensurate with a changein DNBR due to the change of said one parameter with respect to the longterm average value of said parameter, said average value constrained tobe equal to or less limiting on DNBR than the continously generatedvalue of said parameter;
 2. means for generating an electrical signalcommensurate with a preselected value of DNBR which is higher by apredetermined margin than the minimum allowable value of DNBR for whicha critical heat flux is exceeded;
 3. means responsive to said signals ofelements (1) and (2) for summing said signals to generate a signalcommensurate with an updated DNBR margin;
 4. means responsive to saidupdated DNBR margin signal of element (3) and to said electrical signalcommensurate with said index (DNBR index) for selecting the larger ofthe two signals;
 5. means responsive to said one parametric signal forgenerating an electrical signal commensurate with a projected change ofsaid parameteric signal over a projected time period (T), said projectedchange being limited to negative values;
 6. means responsive to saidlarger signal of element (4) and to said signal commensurate with aprojected change of DNBR due to the projected change of said parametricsignal over a projected time period (T) of element (5) for summing saidsignals of elements (5) and (4) to produce a signal commensurate withthe projected value of the DNBR; and
 7. means responsive to saidelectrical signal commensurate with the projected value of DNBR forcorrectively regulating said Nuclear Power System when the projectedvalue of the DNBR violates a design limit.
 37. The improved fuel damageprotection apparatus recited in claim 36 further comprising:1. means forgenerating a trip set point electrical signal commensurate with theminimum allowable DNBR value; and
 2. means responsive to said summedsignal of element (6) of claim 36 and to said trip set point signal ofelement (1) of claim 37 for comparing said signals.
 38. The improvedfuel damage protection apparatus as recited in claim 36 wherein meansfor generating an electrical signal commensurate with a change in DNBRdue to the change of said parameter with respect to the long termaverage value of said parameter includes:1. means responsive to said oneparametric signal for continuously generating an electrical signalcommensurate with the average value of said one parametric signal over apreselected finite period of time, said average value constrained to beequal to or less limiting on DNBR than the continuously generated valueof said parameter;
 2. means for continuously subtracting said signalcommensurate with the average value of said one parametric signal ofelement (1) of claim 38 from the continuously generated value of saidone parametric signal to generate an electrical signal commensurate withthe most recent deviation of said parameter from its average value takenover a finite period of time;
 3. means for multiplying said signalcommensurate with the most recent deviation of said one parameter fromits average value of element (2) of claim 38 by a signal commensuratewith the partial derivative of DNBR with respect to the parameter ofsaid one parametric signal to generate a signal commensurate with thechange in DNBR due to the change of said one parameter.
 39. The improvedfuel damage protection apparatus as recited in claim 38 wherein saidtime period (T) includes the reaction time of said fuel damageprotection apparatus.
 40. The improved fuel damage protection apparatusas recited in claim 36 wherein said time period (T) includes thereaction time of said fuel damage protection apparatus.
 41. A method forthe protection against violation, in real time, of a nuclear reactorpower system design limit, the proximity to which is indicated by anindex, the method comprising:a. anticipating and compensating for theinability of the reactor's protection system to respond instantaneouslyto a rapidly occurring operational transient, said inability due, atleast in part, to the time delays or reaction time inherent in thephysical apparatus of the reactor's protection system, said anticipatingand compensating step including the step of generating an electricalsignal indicative of a projection of the index over a positive timeperiod (T) into the future in response to the dynamic behavior of theindex itself or one of its component parts; and b. correctivelyregulating said nuclear power system in response to said signalindicative of said projection when said index projection violates saiddesign limit.
 42. The method as recited in claim 41 wherein said step ofgenerating a signal indicative of a projection of the index includes thesteps of:a. from the dynamic behavior of said index or a component partthereof, generating an electrical signal indicative of the timederivative of said index; and b. multiplying said time derivative by apositive time period (T) to generate an electrical signal indicative ofa projection of said index into the future over said time period (T).43. The method as recited in claim 42 further including the step ofdetermining protection system reaction time, to be used as said timeperiod (T) over which said projection is made, a portion of saidreaction time being directly attributable to the physical equipmentcomprising the protection system, said step including measuring saidphysical delays.
 44. The method as recited in claim 43 wherein said stepof determining protection system reaction time includes the steps of:a.monitoring reactor flux to obtain a representation of axial powerdistribution; and b. from said representation of axial powerdistribution determining a portion of said reaction time attributable tosaid axial power distribution.